9.8
Critique
Exploitée
· rançongiciel
CVE-2021-21972 VMware vCenter Server Remote Code Execution Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-23
Description
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| VMware vCenter Server | Versions non publiées | |
| VMware Cloud Foundation | Versions non publiées |
Références
- www.vmware.com www.vmware.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de VMware vCenter Server
Les 14 CVE de VMware vCenter Server →
CVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability
7.5
Élevée
CVE-2024-38812
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
9.8
Critique
CVE-2024-37081
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An…
7.8
Élevée
CVE-2024-37080
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol
9.8
Critique