Vulnerability Description
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Cloud Foundation | >= 3.0, < 3.10.1.2 |
| Vmware | Vcenter Server | 6.5 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-ReExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-CoExploitThird Party AdvisoryVDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0002.htmlVendor Advisory
- http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-ReExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-CoExploitThird Party AdvisoryVDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0002.htmlVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-US Government Resource
FAQ
What is CVE-2021-21972?
CVE-2021-21972 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with ...
How severe is CVE-2021-21972?
CVE-2021-21972 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-21972?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Cloud Foundation, Vmware Vcenter Server.