Actively exploited · Published Sep 23, 2021 · Assigned by vmware

CVE-2021-22017

Medium 5.3 Exploited

In plain English

A medium-severity security flaw in VMware vCenter Server, VMware Cloud Foundation. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 49.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)49.2%top 1.1% of all CVEs

Exploited in the wildYesCISA KEV since Jan 10, 2022

Attack tooling1Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jan 24, 2022.

Official description

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

Affected products (as reported)

Vendor	Product	Versions
n/a	VMware vCenter Server, VMware Cloud Foundation	VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2

References

https://www.vmware.com/security/advisories/VMSA-2021-0020.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22017 government-resource