--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: CERT-EU, The Cybersecurity Service for the European Union institutions, bodies, offices and agencies title: 'Critical Vulnerability in VMware vCenter' version: '1.0' number: '2020-021' date: 'April 11, 2020' --- _History:_ * _11/04/2020 --- v1.0 -- Initial publication_ # Summary On April 9, 2020, VMware vCenter Server updates were issued, which address sensitive information disclosure vulnerability in the VMware Directory Service `vmdir` (CVE-2020-3952) [1]. A malicious actor with network access to an affected deployment may be able to extract highly sensitive information which could be used to compromise vCenter Server or other services. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 10.0. # Technical Details A sensitive information disclosure vulnerability in the VMware Directory Service `vmdir` has been discovered [1]. Under certain conditions `vmdir` that ships with VMware vCenter Server does not correctly implement access controls. A malicious actor with network access to an affected `vmdir` deployment may be able to extract highly sensitive information which could be used to compromise vCenter Server or other services which are dependent upon `vmdir` for authentication. # Products Affected VMware vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected, **if it was upgraded from a previous release line** such as 6.0 or 6.5 [2]. VMware vCenter versions 6.5 and 7.0, as well as **clean installations of vCenter Server 6.7** (embedded or external PSC) **are not affected** [1]. # Recommendations Check if your installation is affected by following steps in [2]. If necessary, upgrade to your vCenter Server installation to version 6.7u3f [3]. # References [1] [2] [3]