CVE-2021-21978

2021-03-0317:44:25

vmware

www.cve.org

vmware

view planner

security patch

remote code execution

input validation

authorization

arbitrary file upload

AI Score

9.9

Confidence

High

EPSS

0.975

Percentile

100.0%

JSON

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.

CNA Affected

[
  {
    "product": "VMware View Planner",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "VMware View Planner 4.x prior to 4.6 Security Patch 1"
      }
    ]
  }
]