Back to CVE Browser

CVE-2020-3952

Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score78.5120%

EPSS Percentile91.55th

PublishedApr 10, 2020

Last ModifiedOct 30, 2025

Vulnerability Description

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

Affected Platforms (CPE)

📦

Vmware

Vcenter Server

= 6.7

References & Advisories

🔗 http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html

🔗 https://www.vmware.com/security/advisories/VMSA-2020-0006

🔗 http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html

🔗 https://www.vmware.com/security/advisories/VMSA-2020-0006

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3952

Related Vulnerabilities

CVE-2015-234210.0

The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict re...

CVE-2013-140510.0

VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Up...

CVE-2021-219729.8

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with netwo...

CVE-2021-269879.8

Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible...