Lucene search

[email protected]CVE-2021-21973

HistoryFeb 24, 2021 - 5:15 p.m.

CVE-2021-21973

2021-02-2417:15:15

CWE-918

[email protected]

web.nvd.nist.gov

957

In Wild

vsphere

html5

ssrf

vulnerability

vcenter server

information disclosure

cve-2021-21973

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.163 Low

EPSS

Percentile

96.0%

JSON

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected configurations

NVD

Node

vmwarecloud_foundationRange3.0–3.10.1.2

vmwarecloud_foundationRange4.0–4.2

vmwarevcenter_serverMatch6.5-

vmwarevcenter_serverMatch6.5a

vmwarevcenter_serverMatch6.5b

vmwarevcenter_serverMatch6.5c

vmwarevcenter_serverMatch6.5d

vmwarevcenter_serverMatch6.5e

vmwarevcenter_serverMatch6.5f

vmwarevcenter_serverMatch6.5update1d

vmwarevcenter_serverMatch6.5update1e

vmwarevcenter_serverMatch6.5update1g

vmwarevcenter_serverMatch6.5update2

vmwarevcenter_serverMatch6.5update2b

vmwarevcenter_serverMatch6.5update2c

vmwarevcenter_serverMatch6.5update2d

vmwarevcenter_serverMatch6.5update2g

vmwarevcenter_serverMatch6.5update3

vmwarevcenter_serverMatch6.5update3d

vmwarevcenter_serverMatch6.5update3f

vmwarevcenter_serverMatch6.5update3k

vmwarevcenter_serverMatch6.7-

vmwarevcenter_serverMatch6.7a

vmwarevcenter_serverMatch6.7b

vmwarevcenter_serverMatch6.7d

vmwarevcenter_serverMatch6.7update1

vmwarevcenter_serverMatch6.7update1b

vmwarevcenter_serverMatch6.7update2

vmwarevcenter_serverMatch6.7update2a

vmwarevcenter_serverMatch6.7update2c

vmwarevcenter_serverMatch6.7update3

vmwarevcenter_serverMatch6.7update3a

vmwarevcenter_serverMatch6.7update3b

vmwarevcenter_serverMatch6.7update3f

vmwarevcenter_serverMatch6.7update3g

vmwarevcenter_serverMatch6.7update3j

vmwarevcenter_serverMatch7.0-

vmwarevcenter_serverMatch7.0a

vmwarevcenter_serverMatch7.0b

vmwarevcenter_serverMatch7.0c

vmwarevcenter_serverMatch7.0d

vmwarevcenter_serverMatch7.0update1

vmwarevcenter_serverMatch7.0update1a

CPENameOperatorVersion
vmware:cloud_foundationvmware cloud foundationlt3.10.1.2
vmware:cloud_foundationvmware cloud foundationlt4.2
vmware:vcenter_servervmware vcenter servereq6.5
vmware:vcenter_servervmware vcenter servereq6.7
vmware:vcenter_servervmware vcenter servereq7.0

CPE	Name	Operator	Version
vmware:cloud_foundation	vmware cloud foundation	lt	3.10.1.2
vmware:cloud_foundation	vmware cloud foundation	lt	4.2
vmware:vcenter_server	vmware vcenter server	eq	6.5
vmware:vcenter_server	vmware vcenter server	eq	6.7
vmware:vcenter_server	vmware vcenter server	eq	7.0

CNA Affected

[
  {
    "product": "VMware vCenter Server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "7.x before 7.0 U1c"
      },
      {
        "status": "affected",
        "version": "6.7 before 6.7 U3l"
      },
      {
        "status": "affected",
        "version": "6.5 before 6.5 U3n"
      }
    ]
  },
  {
    "product": "VMware Cloud Foundation",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "4.x before 4.2"
      },
      {
        "status": "affected",
        "version": "3.x before 3.10.1.2"
      }
    ]
  }
]