Actively exploited · Published Mar 31, 2021 · Assigned by vmware
CVE-2021-21983
Medium 6.5
In plain English
A medium-severity security flaw in VMware vRealize Operations. CISA's analysis reports active exploitation. The chance it is exploited in the next 30 days is estimated at 68.8% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)68.8%top 0.7% of all CVEs
Exploited in the wildYesCISA SSVC: active
Attack tooling2Metasploit, Public PoC
Official description
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vRealize Operations | VMware vRealize Operations prior to 8.4 |