CVE‑2020‑3952: VMware vCenter Server Information Disclosure Vulnerability
What It Is – VMware vCenter Server’s Directory Service (vmdir) fails to enforce proper access controls on the Platform Services Controller (PSC). An attacker who can reach the LDAP port 389 on the vCenter network can query the directory and retrieve sensitive configuration data, including service account credentials.
Exploitability – Publicly disclosed; proof‑of‑concept scripts are available. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Affected Products – VMware vCenter Server (all supported versions prior to the November 2020 security patch), including deployments that use the external PSC architecture.
Why It Matters for Trust & Control Assurance
- Access‑control assurance – The flaw demonstrates a gap in logical access segregation for critical directory services, a core control objective that underpins many frameworks (e.g., NIST CSF 2.0 Protect‑PR.AC‑1).
- Audit‑ready evidence – Enterprises must be able to prove that directory access is limited to authorized accounts; this vulnerability erodes that evidentiary trail.
- Continuous monitoring requirement – Detecting unexpected LDAP queries or outbound data flows is essential to maintain a defensible posture and satisfy auditors demanding real‑time control verification.
Recommended Actions
- Apply VMware’s security patch for CVE‑2020‑3952 immediately (see VMware Security Advisory VA‑2020‑0015).
- Restrict network access to port 389 on the PSC/vCenter hosts using firewalls or micro‑segmentation.
- Validate directory ACLs – audit vmdir permissions to ensure only required service accounts have read access.
- Enable logging and alerting for LDAP queries and anomalous directory activity; retain logs for audit purposes.
- Document remediation in your control evidence repository to demonstrate remediation to auditors.
Source: CISA KEV – CVE‑2020‑3952