VMware · vCenter Server
CVE-2021-21985
VMware vCenter Server Improper Input Validation Vulnerability
What it is
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CISA: VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
More exploited flaws from VMware
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Medium 6.5 | 13% |
| Jan 22, 2024 | Out-of-Bounds Write | vCenter Server | Critical 9.8 | 99.2% |
| Jan 10, 2022 | Improper Access Control | vCenter Server | Medium 5.3 | 49% |
| Nov 3, 2021 | Information Disclosure | vCenter Server | Critical 9.8 | 90% |
| Nov 3, 2021 | Remote Code Execution | vCenter Server | Critical 9.8 | 99.9% |
| Nov 3, 2021 | File Upload | vCenter Server | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.