9.8
Critique
CVE-2021-21985 VMware vCenter Server Improper Input Validation Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-20, CWE-918, CWE-470
Description
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| VMware vCenter Server and VMware Cloud Foundation | Versions non publiées |
Autres CVE de VMware vCenter Server and VMware Cloud Foundation
Les 6 CVE de VMware vCenter Server and VMware Cloud Foundation →
CVE-2022-22948
VMware vCenter Server Incorrect Default File Permissions Vulnerability
6.5
Moyenne
CVE-2021-22049
The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web…
Non notée
CVE-2021-21980
The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability
Non notée
CVE-2021-22048
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication)…
Non notée