PT-2020-2027 · Vmware · Vmware Vcenter Server+3

Published 2020-04-09 · Updated 2025-10-30 · CVE-2020-3952

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to the fixed version

Description The issue is related to insufficient access control in the VMware Directory Service (vmdir) of VMware vCenter Server. This can allow a remote attacker to elevate their privileges. The problem occurs because vmdir does not correctly implement access controls under certain conditions.

Recommendations For versions prior to the fixed version, consider disabling the vulnerable vmdir service until a patch is available. Restrict access to the Platform Services Controller (PSC) to minimize the risk of exploitation. Avoid using the vulnerable vmdir functionality in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Missing Authentication

Weakness Enumeration

CWE-863

CWE-306

Related Identifiers

BDU:2020-01603

CVE-2020-3952

VCENTERCVE2020_3952

Affected Products

Platform Services Controller

Vmware Vcenter

Vmware Directory Service

Vmware Vcenter Server

References · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ldap_hashdump.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/vmware_vcenter_vmdir_ldap.rb · Exploit
• 🔥 https://github.com/guardicore/vmware_vcenter_cve_2020_3952 · Exploit
• 🔥 https://github.com/avboy1337/CVE-2020-3952 · Exploit
• 🔥 https://github.com/bb33bb/CVE-2020-3952 · Exploit
• 🔥 https://github.com/0x0000000000-03/CVE-2020-3952 · Exploit
• 🔥 https://github.com/chronoloper/CVE-2020-3952 · Exploit
• 🔥 https://github.com/commandermoon/CVE-2020-3952 · Exploit
• 🔥 https://github.com/Fa1c0n35/vmware_vcenter_cve_2020_3952 · Exploit
• 🔥 https://github.com/gelim/CVE-2020-3952 · Exploit
• 🔥 https://exploit-db.com/exploits/48535 · Exploit
• 🔥 http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html · Exploit
• https://safe-surf.ru/specialists/bulletins-nkcki/686194 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3952 · Vendor Advisory