What’s Vulnerable › Vulnerabilities

CVE-2020-3952: VMware vCenter Server Information Disclosure Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 90.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-04-10 · updated 2026-06-17
• Weakness: CWE-306

Description

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

Affected products

• VMware vCenter Server: 6.7
• VMware vCenter Server: from vCenter Server 6.7 (embedded or external PSC) prior through 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected.

References

• http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html
• https://www.vmware.com/security/advisories/VMSA-2020-0006
• http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html
• https://www.vmware.com/security/advisories/VMSA-2020-0006
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3952

Get alerted when CVE-2020-3952 or the next vulnerability affects your stack