CVE-2020-3952 VMware vCenter Server Information Disclosure

What is CVE-2020-3952?

CVE-2020-3952 is a critical missing authorization vulnerability in Vmware Vcenter Server, published on 10 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

Weakness: CWE-306

Which versions are affected by CVE-2020-3952?

It affects 1 product.

Products include Vmware Vcenter Server.

How do I fix CVE-2020-3952?

No fix has been published for CVE-2020-3952 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-3952 being exploited?

Yes. Attackers have exploited CVE-2020-3952 in the wild since at least 3 Nov 2021.

Public exploit code: 2 Metasploit modules, 1 Exploit-DB entry, 1 Nuclei template and 4 proofs of concept on GitHub.

Other vulnerabilities in Vmware Vcenter Server

• CVE-2026-59310 Broadcom VMware vCenter Path Traversal Exploited Critical 9.8
• CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Exploited Critical 9.8
• CVE-2021-22017 VMware vCenter Server Improper Access Control Exploited Medium 5.3
• CVE-2015-2342 Code injection in n/a Critical 10.0
• CVE-2026-59309 vCenter authentication-bypass vulnerability Critical 9.8

All Vmware Vcenter Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rqpw-v3g2-qccx.