VMwareVMSA-2021-0004.2VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.1 High
AI Score
Confidence
High
8.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:C/A:C
0.974 High
EPSS
Percentile
99.9%
3a. Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975)
The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of βImportantβ severity with a maximum CVSSv3 base score of 8.6.
3b. Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983)
The vRealize Operations Manager API contains an arbitrary file write vulnerability. VMware has evaluated this issue to be of βImportantβ severity with a maximum CVSSv3 base score of 7.2.
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21975
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21983
kb.vmware.com/s/article/82367
kb.vmware.com/s/article/83093
kb.vmware.com/s/article/83094
kb.vmware.com/s/article/83095
kb.vmware.com/s/article/83210
kb.vmware.com/s/article/83260
kb.vmware.com/s/article/83287
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.1 High
AI Score
Confidence
High
8.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:C/A:C
0.974 High
EPSS
Percentile
99.9%