How severe is CVE-2020-3952?

CVE-2020-3952 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 90.4% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2020-3952: VMware vCenter Server Information Disclosure

CISA Known Exploited Vulnerabilities

VMware vCenter Server Information Disclosure Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-11-03

Remediation due

2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2020-3952

Description

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
-	VMware vCenter Server	vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected.

References

2 Links

Other references

Record Details

Published

2020-04-10

Last updated

2025-10-21

Assigner (CNA)

vmware

Credited to

More from VMware

All VMware CVEs→

CVE-2021-219859.8 CRITICAL

VMware vCenter Server Improper Input Validation Vulnerability

KEVEPSS 100.0%2021-05-26

CVE-2021-220059.8 CRITICAL

VMware vCenter Server File Upload Vulnerability

KEVEPSS 100.0%2021-09-23

CVE-2021-219729.8 CRITICAL

VMware vCenter Server Remote Code Execution Vulnerability

KEVEPSS 99.9%2021-02-24

CVE-2023-340489.8 CRITICAL

VMware vCenter Server Out-of-Bounds Write Vulnerability

VMwareKEVEPSS 99.4%2023-10-25

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.