Vulnerability Details : CVE-2020-3994
VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates.
Products affected by CVE-2020-3994
- cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-3994
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 43 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-3994
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
|
7.4
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
2.2
|
5.2
|
NIST |
CWE ids for CVE-2020-3994
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-3994
-
https://www.vmware.com/security/advisories/VMSA-2020-0023.html
VMSA-2020-0023Patch;Vendor Advisory
Jump to