The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
References
| Link | Resource |
|---|---|
| https://www.vmware.com/security/advisories/VMSA-2021-0002.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Aug 2021, 10:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:vmware:vcenter_server:6.7:u3g:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u2:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u1d:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u2g:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u1b:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u2:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u2a:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:7.0:u1a:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u3b:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u2c:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u2c:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:7.0:u1:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u1g:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u2b:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u3:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u1:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u1e:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u3f:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u3a:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u3:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u3j:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u3k:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:u3f:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:u2d:*:*:*:*:*:* |
cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:* |
Information
Published : 2021-02-24 17:15
Updated : 2024-02-15 20:18
NVD link : CVE-2021-21973
Mitre link : CVE-2021-21973
CVE.ORG link : CVE-2021-21973
JSON object : View
Products Affected
vmware
- vcenter_server
- cloud_foundation
CWE
CWE-918
Server-Side Request Forgery (SSRF)