Lucene search

K
cve[email protected]CVE-2021-21983
HistoryMar 31, 2021 - 6:15 p.m.

CVE-2021-21983

2021-03-3118:15:14
web.nvd.nist.gov
178
In Wild
14
cve-2021-21983
vrealize operations manager api
file write vulnerability
nvd
security vulnerability

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

56.0%

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

Affected configurations

NVD
Node
vmwarecloud_foundationMatch3.0
OR
vmwarecloud_foundationMatch3.0.1
OR
vmwarecloud_foundationMatch3.0.1.1
OR
vmwarecloud_foundationMatch3.5
OR
vmwarecloud_foundationMatch3.5.1
OR
vmwarecloud_foundationMatch3.7
OR
vmwarecloud_foundationMatch3.7.1
OR
vmwarecloud_foundationMatch3.7.2
OR
vmwarecloud_foundationMatch3.8
OR
vmwarecloud_foundationMatch3.8.1
OR
vmwarecloud_foundationMatch3.9
OR
vmwarecloud_foundationMatch3.9.1
OR
vmwarecloud_foundationMatch3.10
OR
vmwarecloud_foundationMatch4.0
OR
vmwarecloud_foundationMatch4.0.1
OR
vmwarevrealize_operations_managerMatch7.0.0
OR
vmwarevrealize_operations_managerMatch7.5.0
OR
vmwarevrealize_operations_managerMatch8.0.0
OR
vmwarevrealize_operations_managerMatch8.0.1
OR
vmwarevrealize_operations_managerMatch8.1.0
OR
vmwarevrealize_operations_managerMatch8.1.1
OR
vmwarevrealize_operations_managerMatch8.2.0
OR
vmwarevrealize_operations_managerMatch8.3.0
OR
vmwarevrealize_suite_lifecycle_managerMatch8.0
OR
vmwarevrealize_suite_lifecycle_managerMatch8.0.1
OR
vmwarevrealize_suite_lifecycle_managerMatch8.1
OR
vmwarevrealize_suite_lifecycle_managerMatch8.2

CNA Affected

[
  {
    "product": "VMware vRealize Operations",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "VMware vRealize Operations prior to 8.4"
      }
    ]
  }
]

Social References

More

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

56.0%