Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-21985
HistoryMay 26, 2021 - 3:15 p.m.

CVE-2021-21985

2021-05-2615:15:07
CWE-20
[email protected]
web.nvd.nist.gov
4

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.974 High

EPSS

Percentile

99.9%

JSON

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Affected configurations

NVD
Node
vmwarevcenter_serverMatch6.5-
OR
vmwarevcenter_serverMatch6.5a
OR
vmwarevcenter_serverMatch6.5b
OR
vmwarevcenter_serverMatch6.5c
OR
vmwarevcenter_serverMatch6.5d
OR
vmwarevcenter_serverMatch6.5e
OR
vmwarevcenter_serverMatch6.5f
OR
vmwarevcenter_serverMatch6.5update1
OR
vmwarevcenter_serverMatch6.5update1b
OR
vmwarevcenter_serverMatch6.5update1c
OR
vmwarevcenter_serverMatch6.5update1d
OR
vmwarevcenter_serverMatch6.5update1e
OR
vmwarevcenter_serverMatch6.5update1g
OR
vmwarevcenter_serverMatch6.5update2
OR
vmwarevcenter_serverMatch6.5update2b
OR
vmwarevcenter_serverMatch6.5update2c
OR
vmwarevcenter_serverMatch6.5update2d
OR
vmwarevcenter_serverMatch6.5update2g
OR
vmwarevcenter_serverMatch6.5update3
OR
vmwarevcenter_serverMatch6.5update3d
OR
vmwarevcenter_serverMatch6.5update3f
OR
vmwarevcenter_serverMatch6.5update3k
OR
vmwarevcenter_serverMatch6.5update3n
OR
vmwarevcenter_serverMatch6.7-
OR
vmwarevcenter_serverMatch6.7a
OR
vmwarevcenter_serverMatch6.7b
OR
vmwarevcenter_serverMatch6.7d
OR
vmwarevcenter_serverMatch6.7update1
OR
vmwarevcenter_serverMatch6.7update1b
OR
vmwarevcenter_serverMatch6.7update2
OR
vmwarevcenter_serverMatch6.7update2a
OR
vmwarevcenter_serverMatch6.7update2c
OR
vmwarevcenter_serverMatch6.7update3
OR
vmwarevcenter_serverMatch6.7update3a
OR
vmwarevcenter_serverMatch6.7update3b
OR
vmwarevcenter_serverMatch6.7update3f
OR
vmwarevcenter_serverMatch6.7update3g
OR
vmwarevcenter_serverMatch6.7update3j
OR
vmwarevcenter_serverMatch6.7update3l
OR
vmwarevcenter_serverMatch6.7update3m
OR
vmwarevcenter_serverMatch7.0-
OR
vmwarevcenter_serverMatch7.0a
OR
vmwarevcenter_serverMatch7.0b
OR
vmwarevcenter_serverMatch7.0c
OR
vmwarevcenter_serverMatch7.0d
OR
vmwarevcenter_serverMatch7.0update1
OR
vmwarevcenter_serverMatch7.0update1a
OR
vmwarevcenter_serverMatch7.0update1c
OR
vmwarevcenter_serverMatch7.0update1d
OR
vmwarevcenter_serverMatch7.0update2
OR
vmwarevcenter_serverMatch7.0update2a
Node
vmwarecloud_foundationRange3.0โ€“3.10.2.1
OR
vmwarecloud_foundationRange4.0โ€“4.2.1

Related

cve 1
threatpost 3
nuclei 1
cvelist 1
cisa 1
checkpoint_advisories 1
githubexploit 9
nessus 2
cisa_kev 1
prion 1
trellix 2
seebug 1
metasploit 1
rapid7blog 3
thn 3
vmware 1
packetstorm 1
zdt 1
attackerkb 1
ibm 1
avleonov 1
qualysblog 2
ics 2
cve
cve
CVE-2021-21985
2021-05-26 15:15:07
threatpost
threatpost
New Ransomware Gangs Haron & BlackMatter Are After Fat Cats
2021-07-28 18:33:02
VMware Sounds Ransomware Alarm Over Critical Severity Bug
2021-05-26 19:45:50
CISAโ€™s Top 30 Bugs: Oneโ€™s Old Enough to Buy Beer
2021-07-29 18:39:56
nuclei
nuclei
VMware vSphere Client (HTML5) - Remote Code Execution
2021-05-31 13:50:59
cvelist
cvelist
CVE-2021-21985
2021-05-26 14:04:30
cisa
cisa
Unpatched VMware vCenter Software
2021-06-04 00:00:00
checkpoint_advisories
checkpoint_advisories
VMware vCenter Server Remote Code Execution (CVE-2021-21985)
2021-06-08 00:00:00
githubexploit
githubexploit
Exploit for Improper Input Validation in Vmware Vcenter Server
2021-06-03 12:17:06
Exploit for Improper Input Validation in Vmware Vcenter Server
2021-07-11 20:38:19
Exploit for Improper Input Validation in Vmware Vcenter Server
2021-06-05 11:03:13
nessus
nessus
VMware vCenter Server Virtual SAN Health Check plug-in RCE (CVE-2021-21985) (direct check)
2021-06-03 00:00:00
VMware vCenter Server 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2021-0010)
2021-05-25 00:00:00
cisa_kev
cisa_kev
VMware vCenter Server Improper Input Validation Vulnerability
2021-11-03 00:00:00
prion
prion
Remote code execution
2021-05-26 15:15:00
trellix
trellix
Are Virtual Machines the New Gold for Cyber Criminals?
2021-06-10 00:00:00
Are Virtual Machines the New Gold for Cyber Criminals?
2021-06-10 00:00:00
seebug
seebug
VMware vCenter Server่ฟœ็จ‹ไปฃ็ ๆ‰ง่กŒๆผๆดž๏ผˆCVE-2021-21985๏ผ‰
2021-05-26 00:00:00
metasploit
metasploit
VMware vCenter Server Virtual SAN Health Check Plugin RCE
2021-07-12 18:07:05
rapid7blog
rapid7blog
CVE-2021-21985: What you need to know about the latest critical vCenter Server vulnerability
2021-05-26 18:57:20
Metasploit Wrap-Up
2021-07-16 19:47:06
Critical vCenter Server File Upload Vulnerability (CVE-2021-22005)
2021-09-21 19:55:35
thn
thn
ALERT: Critical RCE Bug in VMware vCenter Server Under Active Attack
2021-06-05 10:58:00
Critical RCE Vulnerability Found in VMware vCenter Server โ€” Patch Now!
2021-05-26 04:57:00
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
2021-07-29 08:21:00
vmware
vmware
VMware vCenter Server updates address remote code execution and authentication vulnerabilities (CVE-2021-21985, CVE-2021-21986)
2021-05-25 00:00:00
packetstorm
packetstorm
VMware vCenter Server Virtual SAN Health Check Remote Code Execution
2021-07-13 00:00:00
zdt
zdt
VMware vCenter Server Virtual SAN Health Check Remote Code Execution Exploit
2021-07-16 00:00:00
attackerkb
attackerkb
CVE-2021-21985
2021-05-26 00:00:00
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in VMware vCenter affect IBM Cloud Pak System
2022-05-06 21:11:34
avleonov
avleonov
Last Weekโ€™s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins
2021-07-19 16:29:00
qualysblog
qualysblog
CISA Alert: Top Routinely Exploited Vulnerabilities
2021-07-29 00:20:27
Qualys Response to CISA Alert: Binding Operational Directive 22-01
2021-11-09 06:15:01
ics
ics
Top Routinely Exploited Vulnerabilities
2021-08-20 12:00:00
2021 Top Routinely Exploited Vulnerabilities
2022-04-28 12:00:00

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.974 High

EPSS

Percentile

99.9%

JSON
Related for NVD:CVE-2021-21985
cve1threatpost3nuclei1cvelist1cisa1checkpoint_advisories1githubexploit9nessus2cisa_kev1prion1trellix2seebug1metasploit1rapid7blog3thn3vmware1packetstorm1zdt1attackerkb1ibm1avleonov1qualysblog2ics2