by Kastro
Paper/Archive/CVE-2021-21985

CVE-2021-21985

VMware vCenter Server — VMware vCenter Server Improper Input Validation Vulnerability

KEV · due 17 Novransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Affected

ProductAffectedFixed inSource
VMware vCenter Server and VMware Cloud FoundationVMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1, 3.x before 3.10.2.1)–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2021-0010.htmlrefpacketstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.htmlrefpacketstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21985kevcisa.gov/known-exploited-vulnerabilities-catalog