VMware · vCenter Server and Cloud Foundation
CVE-2021-21973
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
What it is
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CISA: VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 21, 2022
- Added to the CISA list
- March 7, 2022
- Published
- February 24, 2021
- Severity
- Medium 5.3 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 88% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-20 CWE-918
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from VMware
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 4, 2025 | TOCTOU Race Condition | ESXi and Workstation | Critical 9.3 | 1.6% |
| Mar 4, 2025 | Arbitrary Write | ESXi | High 8.2 | 1.0% |
| Mar 4, 2025 | Information Disclosure | ESXi, Workstation, and Fusion | High 7.1 | 1.6% |
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Jul 30, 2024 | Authentication Bypass | ESXi | Medium 6.8 | 27% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Medium 6.5 | 13% |
| Jan 22, 2024 | Out-of-Bounds Write | vCenter Server | Critical 9.8 | 99.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.