VMware · vCenter Server
CVE-2021-21972
VMware vCenter Server Remote Code Execution Vulnerability
O que é
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CISA: VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 17 de novembro de 2021
- Adicionada à lista da CISA
- 3 de novembro de 2021
- Publicada
- 24 de fevereiro de 2021
- Gravidade
- Crítica 9,8 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99,9% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-23
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (4)
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html
- http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html
- http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html
Mais falhas exploradas de VMware
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 20 de nov. de 2024 | Heap-Based Buffer Overflow | vCenter Server | Crítica 9,8 | 55% |
| 20 de nov. de 2024 | Privilege Escalation | vCenter Server | Alto 7,5 | 17% |
| 17 de jul. de 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Média 6,5 | 13% |
| 22 de jan. de 2024 | Out-of-Bounds Write | vCenter Server | Crítica 9,8 | 99,2% |
| 10 de jan. de 2022 | Improper Access Control | vCenter Server | Média 5,3 | 49% |
| 3 de nov. de 2021 | Information Disclosure | vCenter Server | Crítica 9,8 | 90% |
| 3 de nov. de 2021 | Improper Input Validation | vCenter Server | Crítica 9,8 | >99,9% |
| 3 de nov. de 2021 | File Upload | vCenter Server | Crítica 9,8 | >99,9% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.