CVE-2020-3952

CRITICALCISA KEV

9.8

Description

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie4/10/2020

Derniere modification10/30/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurVMware

ProduitvCenter Server

Nom vulnerabiliteVMware vCenter Server Information Disclosure Vulnerability

Date ajout KEV2021-11-03

Date limite remediation2022-05-03

Utilise dans ransomwareUnknown

Produits affectes

vmware:vcenter_server

Faiblesses (CWE)

CWE-306CWE-306

References

http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html(security@vmware.com)

https://www.vmware.com/security/advisories/VMSA-2020-0006(security@vmware.com)

http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.vmware.com/security/advisories/VMSA-2020-0006(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3952(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.