VMware · vCenter Server

CVE-2021-22017

VMware vCenter Server Improper Access Control

Exploited in attacks Medium 5.3 Attack chance: 49%

What it is

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

CISA: Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: January 24, 2022

Added to the CISA list: January 10, 2022
Published: September 23, 2021
Severity: Medium 5.3 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 49% in the top 1.1% of all known vulnerabilities
Weakness: CWE-23
More details: NVD · CVE.org · CISA

All references (1)

https://www.vmware.com/security/advisories/VMSA-2021-0020.html

More exploited flaws from VMware

Added	Vulnerability	Product	Severity	Attack chance
Nov 20, 2024	Heap-Based Buffer OverflowCVE-2024-38812	vCenter Server	Critical 9.8	55%
Nov 20, 2024	Privilege EscalationCVE-2024-38813	vCenter Server	High 7.5	17%
Jul 17, 2024	Incorrect Default File Permissions Vulnerability CVE-2022-22948	vCenter Server	Medium 6.5	13%
Jan 22, 2024	Out-of-Bounds WriteCVE-2023-34048	vCenter Server	Critical 9.8	99.2%
Nov 3, 2021	Information DisclosureCVE-2020-3952	vCenter Server	Critical 9.8	90%
Nov 3, 2021	Remote Code ExecutionCVE-2021-21972used by ransomware	vCenter Server	Critical 9.8	99.9%
Nov 3, 2021	Improper Input ValidationCVE-2021-21985used by ransomware	vCenter Server	Critical 9.8	>99.9%
Nov 3, 2021	File UploadCVE-2021-22005used by ransomware	vCenter Server	Critical 9.8	>99.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.