VMware · vRealize Operations Manager API
CVE-2021-21975
VMware Server Side Request Forgery in vRealize Operations Manager API
What it is
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CISA: Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: February 1, 2022
More exploited flaws from VMware
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 4, 2025 | TOCTOU Race Condition | ESXi and Workstation | Critical 9.3 | 1.6% |
| Mar 4, 2025 | Arbitrary Write | ESXi | High 8.2 | 1.0% |
| Mar 4, 2025 | Information Disclosure | ESXi, Workstation, and Fusion | High 7.1 | 1.6% |
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Jul 30, 2024 | Authentication Bypass | ESXi | Medium 6.8 | 27% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Medium 6.5 | 13% |
| Jan 22, 2024 | Out-of-Bounds Write | vCenter Server | Critical 9.8 | 99.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.