{"id":"CVE-2020-3952","published":"2020-04-10T14:15:12Z","modified":"2026-06-17T03:19:19Z","title":"VMware vCenter Server Information Disclosure Vulnerability","vendor":"VMware","product":"vCenter Server","tier":"core","eol":null,"description":{"text":"Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the vmdir component shipped with VMware vCenter Server, where it runs as part of an embedded or external Platform Services Controller (PSC) and does not correctly implement access controls. An attacker with network access can exploit it without authentication or user interaction, under the specific conditions that trigger the access control failure.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:04Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.90384,"percentile":0.99799,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-3952","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-03","exploitedFirstSeen":"2021-11-03","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/05/08/inside-lockbit-defense-lessons-from-the-leaked-lockbit-negotiations","date":"2025-05-08"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2020-0006","tags":["Broken Link","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2020-0006","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3952","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-exposed vCenter service exploited without authentication","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller","start":26,"end":134}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Access control flaw yields unauthorized account and credential access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"does not correctly implement access controls","start":142,"end":186}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-25217","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25217","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":48535,"url":"https://www.exploit-db.com/exploits/48535","title":"VMware vCenter Server 6.7 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2020-06-01","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-06-01"},"pocGithub":{"count":4,"skipped":0,"earliest":"2020-04-15","earliestUrl":"https://github.com/chronoloper/CVE-2020-3952","repos":[{"name":"guardicore/vmware_vcenter_cve_2020_3952","url":"https://github.com/guardicore/vmware_vcenter_cve_2020_3952","stars":274,"created":"2020-04-16"},{"name":"chronoloper/CVE-2020-3952","url":"https://github.com/chronoloper/CVE-2020-3952","stars":4,"created":"2020-04-15"},{"name":"Fa1c0n35/vmware_vcenter_cve_2020_3952","url":"https://github.com/Fa1c0n35/vmware_vcenter_cve_2020_3952","stars":4,"created":"2020-04-19"},{"name":"gelim/CVE-2020-3952","url":"https://github.com/gelim/CVE-2020-3952","stars":2,"created":"2020-04-17"}]},"metasploit":[{"name":"VMware vCenter Server vmdir Authentication Bypass","module":"auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass","type":"auxiliary","disclosureDate":"2020-04-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb"},{"name":"VMware vCenter Server vmdir Information Disclosure","module":"auxiliary/gather/vmware_vcenter_vmdir_ldap","type":"auxiliary","disclosureDate":"2020-04-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/vmware_vcenter_vmdir_ldap.rb"}],"nuclei":[{"id":"CVE-2020-3952","name":"VMware vCenter Server LDAP Broken Access Control","severity":"critical","path":"http/cves/2020/CVE-2020-3952.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3952.yaml"}],"first":{"date":"2020-04-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2020-04-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-04-15, Exploit-DB 2020-06-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb","provenance":"source"},{"date":"2020-04-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3952","provenance":"source"},{"date":"2021-11-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25217","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":572},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1824 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 4 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}