9.8
Critical
Exploited
· ransomware
CVE-2021-21985 VMware vCenter Server Improper Input Validation Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-20, CWE-918, CWE-470
Description
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware vCenter Server and VMware Cloud Foundation | Versions not published |
References
- www.vmware.com www.vmware.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of VMware vCenter Server and VMware Cloud Foundation
The 6 CVEs of VMware vCenter Server and VMware Cloud Foundation →
CVE-2022-22948
VMware vCenter Server Incorrect Default File Permissions Vulnerability
6.5
Medium
CVE-2021-22049
The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web…
Not rated
CVE-2021-21980
The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability
Not rated
CVE-2021-22048
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication)…
Not rated