Vulnerability · Published Mar 3, 2021 · Assigned by vmware
CVE-2021-21978
Critical 9.8
In plain English
A critical-severity security flaw in VMware View Planner. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 99.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Official description
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware View Planner | VMware View Planner 4.x prior to 4.6 Security Patch 1 |