CVE-2021-21975 — HIGH (7.5)

Vulnerability Description

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Vmware	Cloud Foundation	3.0
Vmware	Vrealize Operations Manager	7.0.0
Vmware	Vrealize Suite Lifecycle Manager	8.0

Related Weaknesses (CWE)

CWE-918

References

http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-SExploitThird Party AdvisoryVDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0004.htmlVendor Advisory
http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-SExploitThird Party AdvisoryVDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0004.htmlVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-US Government Resource

FAQ

What is CVE-2021-21975?

CVE-2021-21975 is a vulnerability with a CVSS score of 7.5 (HIGH). Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server...

How severe is CVE-2021-21975?

CVE-2021-21975 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21975?

Check the references section above for vendor advisories and patch information. Affected products include: Vmware Cloud Foundation, Vmware Vrealize Operations Manager, Vmware Vrealize Suite Lifecycle Manager.