CVE-2020-3952
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or...
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- Record
CVE-2020-3952- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- Record
CVE-2020-3952- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2020-25217
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- Record
EUVD-2020-25217- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rqpw-v3g2-qccx
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or...
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- Record
GHSA-rqpw-v3g2-qccx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-306, CWE-863
- Updated
- 2026-11-02
CISA KEV No score
VMware vCenter Server Information Disclosure Vulnerability
VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
- Record
CVE-2020-3952- Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | chronoloper/CVE-2020-3952 | 2020-04-15 |
| PoC in GitHub | guardicore/vmware_vcenter_cve_2020_3952 | 2020-04-16 |
| PoC in GitHub | gelim/CVE-2020-3952 | 2020-04-17 |
| PoC in GitHub | Fa1c0n35/vmware_vcenter_cve_2020_3952 | 2020-04-19 |
| Exploit-DB | VMware vCenter Server 6.7 - Authentication Bypass | 2020-06-01 |
| Metasploit | VMware vCenter Server vmdir Authentication Bypass | 2020-04-09 |
| Metasploit | VMware vCenter Server vmdir Information Disclosure | 2020-04-09 |
| Nuclei | VMware vCenter Server LDAP Broken Access Control |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits | PoC in GitHub | |
| exploits | PoC in GitHub | |
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-3952 is a critical vulnerability (CVSS 9.8) in Vmware Vcenter Server, published April 10, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.4%, the 99th percentile. No source names a fixed version.