by Kastro
Paper/Archive/CVE-2021-21972

CVE-2021-21972

VMware vCenter Server — VMware vCenter Server Remote Code Execution Vulnerability

KEV · due 17 Novransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected

ProductAffectedFixed inSource
VMware vCenter Server7.x before 7.0 U1c–CNA
VMware vCenter Server6.7 before 6.7 U3l–CNA
VMware vCenter Server6.5 before 6.5 U3n–CNA
VMware Cloud Foundation4.x before 4.2–CNA
VMware Cloud Foundation3.x before 3.10.1.2–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2021-0002.htmlrefpacketstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.htmlrefpacketstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21972kevcisa.gov/known-exploited-vulnerabilities-catalog