VMware · vCenter Server
CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
What it is
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CISA: VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from VMware
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Medium 6.5 | 13% |
| Jan 22, 2024 | Out-of-Bounds Write | vCenter Server | Critical 9.8 | 99.2% |
| Jan 10, 2022 | Improper Access Control | vCenter Server | Medium 5.3 | 49% |
| Nov 3, 2021 | Remote Code Execution | vCenter Server | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Improper Input Validation | vCenter Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | File Upload | vCenter Server | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.