# CVE-2020-3952: VMware vCenter Server Information Disclosure Vulnerability

Source: https://junglewise.ai/threats/cve-2020-3952-vmware-vcenter-server-information-disclosure-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2020-3952 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) due to improper access control implementation in the Platform Services Controller (PSC). An unauthenticated attacker with network access to port 389 can exploit this to extract sensitive information or potentially achieve authentication bypass.

## Quick answers

**Is CVE-2020-3952 exploited in the wild?** Yes. CVE-2020-3952 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2020-3952?** Critical severity, with a CVSS score of 9.8, published 3 November 2021.

**Which products and versions are affected?** VMware vCenter Server 6.7.

**Is there a fix for CVE-2020-3952?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-3952 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-3952?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- VMware vCenter Server 6.7

## Timeline

- 2020-04-10: disclosed: Initial NVD publication and VMware advisory VMSA-2020-0006
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2021-11-03: exploited: Confirmed exploited in the wild per CISA KEV entry