← CVE Radar
CVE-2020-3952VMware vCenter Server Information Disclosure Vulnerability
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
9.8 CRITICALEPSS 90.38%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 6.8 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due May 3, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2020-3952
- Status
- Analyzed
- Assigner (CNA)
- vmware
- Published
- Apr 10, 2020
- Last modified
- 2026-06-17 03:19 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
VMware vCenter Server1 version range
- vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected.