Actively exploited · Published Feb 24, 2021 · Assigned by vmware
CVE-2021-21973
Medium 5.3 Exploited
In plain English
A medium-severity server-side request forgery in VMware Cloud Foundation. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2022). The chance it is exploited in the next 30 days is estimated at 88.0% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 21, 2022.
Official description
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vCenter Server | 7.x before 7.0 U1c6.7 before 6.7 U3l6.5 before 6.5 U3n |
| n/a | VMware Cloud Foundation | 4.x before 4.23.x before 3.10.1.2 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973 government-resource