VMware · vCenter Server
CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
무엇인가
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CISA: VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 5월 3일
VMware의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2024. 11. 20. | Heap-Based Buffer Overflow | vCenter Server | 치명적 9.8 | 55% |
| 2024. 11. 20. | Privilege Escalation | vCenter Server | 높음 7.5 | 17% |
| 2024. 7. 17. | Incorrect Default File Permissions Vulnerability | vCenter Server | 보통 6.5 | 13% |
| 2024. 1. 22. | Out-of-Bounds Write | vCenter Server | 치명적 9.8 | 99.2% |
| 2022. 1. 10. | Improper Access Control | vCenter Server | 보통 5.3 | 49% |
| 2021. 11. 3. | Remote Code Execution | vCenter Server | 치명적 9.8 | 99.9% |
| 2021. 11. 3. | Improper Input Validation | vCenter Server | 치명적 9.8 | >99.9% |
| 2021. 11. 3. | File Upload | vCenter Server | 치명적 9.8 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.