CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
Description
CVE-2020-3952 is a critical information disclosure vulnerability in VMware vCenter Server caused by missing authentication in the VMware Directory Service (vmdir). When the Platform Services Controller (PSC) does not correctly implement access controls, an attacker with network access to port 389 can extract highly sensitive information without any authentication. CISA has added CVE-2020-3952 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.36% (99.96th percentile), this VMware vCenter Server vulnerability has a near-certain probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | vcenter server | 6.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.vmware.com/security/advisories/VMSA-2020-0006(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3952(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Missing Authentication for Critical Function occurs when software does not perform any authentication for functionality that requires a provable user identity. In CVE-2020-3952, the VMware Directory Service (vmdir) within vCenter Server fails to implement proper access controls on its LDAP interface (port 389), allowing unauthenticated attackers to access and extract sensitive directory data that should require valid credentials.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2020-3952 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating an extremely severe vulnerability. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable. Confidentiality (High): The vmdir service stores critical infrastructure data including SSO credentials, certificates, and configuration data for the entire vSphere environment. Unauthorized access can expose the complete authentication and authorization framework. Integrity (High): With access to the directory service, an attacker could potentially modify authentication entries, add administrator accounts, or alter trust relationships across the VMware infrastructure. Availability (High): Compromise of the directory service could lead to service disruption across the entire vSphere environment. The EPSS score of 94.36% confirms near-certain exploitation activity, underscoring the urgency of patching this vulnerability.
Exploit Maturity
CVE-2020-3952 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available via Packet Storm Security, providing attackers with a ready-to-use authentication bypass tool. The EPSS score of 94.36% (99.96th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted VMware vulnerabilities. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Refer to VMware Security Advisory VMSA-2020-0006 for specific patch information for vCenter Server 6.7.
- Verify that all instances of VMware vCenter Server 6.7 have been updated to the latest patched version. The vulnerability specifically affects vCenter Server 6.7 installations with embedded or external Platform Services Controller.
- Restrict network access to port 389 (LDAP) on the vCenter Server using firewall rules and network segmentation. Only allow connections from trusted management networks and authorized administrators.
- Monitor vmdir and vCenter Server logs for indicators of compromise, including unauthorized LDAP queries, unexpected directory data extraction, and suspicious authentication-related activity on port 389.
- Implement authentication requirements on all directory service interfaces as a long-term hardening measure. Review and audit access controls on the Platform Services Controller to ensure all critical functions require proper authentication.
Technical Details
CVE-2020-3952 is an information disclosure vulnerability in the VMware Directory Service (vmdir) that ships with VMware vCenter Server 6.7 as part of the embedded or external Platform Services Controller (PSC). The root cause is a missing authentication weakness (CWE-306) where the vmdir LDAP interface on port 389 does not correctly enforce access controls under certain conditions. This allows an unauthenticated attacker with network access to the LDAP port to query and extract sensitive directory data, including SSO credentials and certificates that govern the entire vSphere environment. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is a network-accessible vulnerability with maximum exploitability characteristics: low complexity, no privileges required, and no user interaction needed, with complete impact on all three security dimensions.
Frequently Asked Questions
Is CVE-2020-3952 being actively exploited?
Yes. CVE-2020-3952 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.36% (99.96th percentile) indicates near-certain exploitation activity. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2020-3952?
CVE-2020-3952 specifically affects VMware vCenter Server version 6.7 with embedded or external Platform Services Controller (PSC). The VMware Directory Service (vmdir) component is the affected service, accessible via LDAP on port 389.
How do I fix CVE-2020-3952?
Apply updates per vendor instructions as detailed in VMware Security Advisory VMSA-2020-0006. If immediate patching is not feasible, restrict network access to port 389 on the vCenter Server and monitor for unauthorized LDAP queries.
How severe is CVE-2020-3952?
CVE-2020-3952 has a CVSS 3.1 score of 9.8 (CRITICAL). The vulnerability allows unauthenticated extraction of sensitive directory data from the VMware Directory Service. The EPSS score of 94.36% places it in the 99.96th percentile, indicating near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.