critical9.8Known exploitedPublic exploit code
CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- VMware vCenter Server 6.7 - Authentication Bypass2020-06-01 · webapps · multiple
Impact
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Vcenter Server | Version 6.7 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html
- https://www.vmware.com/security/advisories/VMSA-2020-0006
- http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html
- https://www.vmware.com/security/advisories/VMSA-2020-0006
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3952