PT-2020-4414 · Vmware · Vcenter Server+1

Thorsten Tüllmann · Published 2020-10-20 · Updated 2021-08-24 · CVE-2020-3994

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: VMware vCenter Server versions 6.7 before 6.7u3, 6.6 before 6.5u3k

Description: The issue is related to a lack of certificate validation in the vCenter Server Appliance Management Interface update function, which can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates.

Recommendations: For versions 6.7 before 6.7u3, update to version 6.7u3 or later to resolve the issue. For versions 6.6 before 6.5u3k, update to version 6.5u3k or later to resolve the issue. As a temporary workaround, consider restricting network access to the vCenter Server Appliance Management Interface to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2020-04942

CVE-2020-3994

Affected Products

Vmware Vcenter

Vcenter Server

References · 6

• https://vmware.com/security/advisories/VMSA-2020-0023.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3994 · Security Note
• https://bdu.fstec.ru/vul/2020-04942 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3994 · Vendor Advisory
• https://t.me/cvenotify/19980 · Telegram Post
• https://vuldb.com/?id.162967 · Note