{"uuid": "c8c78321-9f50-4147-875a-8165feae80e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3952", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb", "content": "{\"actions\": [{\"description\": \"Add an admin user\", \"name\": \"Add\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"Hynek Petrak\", \"JJ Lehmann\", \"Ofri Ziv\", \"wvu \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module bypasses LDAP authentication in VMware vCenter Server's\\n          vmdir service to add an arbitrary administrator user. Version 6.7\\n          prior to the 6.7U3f update is vulnerable, only if upgraded from a\\n          previous release line, such as 6.0 or 6.5.\\n          Note that it is also possible to provide a bind username and password\\n          to authenticate if the target is not vulnerable. It will add an\\n          arbitrary administrator user the same way.\", \"disclosure_date\": \"2020-04-09\", \"fullname\": \"auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass\", \"is_install_path\": true, \"mod_time\": \"2025-05-28 09:23:36 +0000\", \"name\": \"VMware vCenter Server vmdir Authentication Bypass\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"admin/ldap/vmware_vcenter_vmdir_auth_bypass\", \"references\": [\"CVE-2020-3952\", \"URL-https://www.guardicore.com/2020/04/pwning-vmware-vcenter-cve-2020-3952/\", \"URL-https://www.vmware.com/security/advisories/VMSA-2020-0006.html\", \"URL-https://github.com/HynekPetrak/HynekPetrak/blob/master/take_over_vcenter_670.md\"], \"rport\": 636, \"session_types\": [\"ldap\"], \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:52.441829Z"}