Improper access control in vCenter Server - CVE-2020-3952
Published: April 12, 2020 / Updated: February 20, 2022
Vulnerability identifier: #VU26758
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3952
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions within the VMware Directory Service (vmdir), that is shipped with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC). A remote attacker can bypass implemented security restrictions and gain unauthorized access to sensitive information and compromise the affected system.
Affected software
vCenter Server
Dell Enterprise Hybrid Cloud
VxFlex Integrated Rack
Dell Enterprise Hybrid Cloud
VxFlex Integrated Rack
How to mitigate CVE-2020-3952
Install updates from vendor's website.
vCenter Server - update to 6.7 U3f
VxFlex Integrated Rack - update to 3.5.2.1
VxFlex Integrated Rack - update to 3.5.2.1
Links to Public Exploits and PoC-codes
- Exploit #4521 - LDAP Information Disclosure (August 30, 2020)
- Exploit #2930 - CVE-2020-3952 (Vuln Check) (June 3, 2020)
- Exploit #2934 - https-github.com-guardicore-vmware_vcenter_cve_2020_3952 () (June 3, 2020)
- Exploit #2810 - VMware vCenter Server 6.7 Authentication Bypass (June 2, 2020)
- Exploit #2809 - VMware vCenter Server 6.7 - Authentication Bypass (June 2, 2020)
- Exploit #2599 - VMware vCenter Server vmdir Information Disclosure (April 23, 2020)
- Exploit #2598 - VMware vCenter Server vmdir Authentication Bypass (April 23, 2020)
- Exploit #2596 - CVE-2020-3952 (Working Exploit PoC for VMWare vCenter Server (CVE-2020-3952) - Reverse Bind Shell) (April 23, 2020)
- Exploit #2595 - vmware_vcenter_cve_2020_3952 (Exploit for CVE-2020-3952 in vCenter 6.7 https://www.guardicore.com/2020/04/pwning-vmware-vcenter-cve-2020-3952/) (April 22, 2020)
- Exploit #2585 - CVE-2020-3952 (VMWare vmdir missing access control exploit checker) (April 19, 2020)
- Exploit #2583 - vmware_vcenter_cve_2020_3952 (Exploit for CVE-2020-3952 in vCenter 6.7) (April 16, 2020)
- Exploit #2582 - CVE-2020-3952 (Working Exploit PoC for VMWare vCenter Server (CVE-2020-3952) - Reverse Bind Shell) (April 16, 2020)