CVE-2021-21983
Last modified
CVE-2021-21983 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.. EPSS estimates a 68.56% chance of exploitation in the next 30 days.
Description
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Cloud Foundation | 3.0 |
| Vmware | Cloud Foundation | 3.0.1 |
| Vmware | Cloud Foundation | 3.0.1.1 |
| Vmware | Cloud Foundation | 3.5 |
| Vmware | Cloud Foundation | 3.5.1 |
| Vmware | Cloud Foundation | 3.7 |
| Vmware | Cloud Foundation | 3.7.1 |
| Vmware | Cloud Foundation | 3.7.2 |
| Vmware | Cloud Foundation | 3.8 |
| Vmware | Cloud Foundation | 3.8.1 |
| Vmware | Cloud Foundation | 3.9 |
| Vmware | Cloud Foundation | 3.9.1 |
| Vmware | Cloud Foundation | 3.10 |
| Vmware | Cloud Foundation | 4.0 |
| Vmware | Cloud Foundation | 4.0.1 |
| Vmware | Vrealize Operations Manager | 7.0.0 |
| Vmware | Vrealize Operations Manager | 7.5.0 |
| Vmware | Vrealize Operations Manager | 8.0.0 |
| Vmware | Vrealize Operations Manager | 8.0.1 |
| Vmware | Vrealize Operations Manager | 8.1.0 |
| Vmware | Vrealize Operations Manager | 8.1.1 |
| Vmware | Vrealize Operations Manager | 8.2.0 |
| Vmware | Vrealize Operations Manager | 8.3.0 |
| Vmware | Vrealize Suite Lifecycle Manager | 8.0 |
| Vmware | Vrealize Suite Lifecycle Manager | 8.0.1 |
| Vmware | Vrealize Suite Lifecycle Manager | 8.1 |
| Vmware | Vrealize Suite Lifecycle Manager | 8.2 |
References
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-21983?
How severe is CVE-2021-21983?
How do I fix CVE-2021-21983?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-21978VMware View Planner 4.x prior to 4.6 Security Patch 1 contai…9.8
- CVE-2021-21979In Bitnami Containers, all Laravel container versions prior …7.3
- CVE-2021-2198Vulnerability in the Oracle Knowledge Management product of …8.2
- CVE-2021-21980The vSphere Web Client (FLEX/Flash) contains an unauthorized…7.5
- CVE-2021-21981VMware NSX-T contains a privilege escalation vulnerability d…7.8
- CVE-2021-21982VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 …9.1
- CVE-2021-21984VMware vRealize Business for Cloud 7.x prior to 7.6.0 contai…9.8
- CVE-2021-21985The vSphere Client (HTML5) contains a remote code execution …9.8
- CVE-2021-21986The vSphere Client (HTML5) contains a vulnerability in a vSp…9.8
- CVE-2021-21987VMware Workstation (16.x prior to 16.1.2) and Horizon Client…6.5
- CVE-2021-21988VMware Workstation (16.x prior to 16.1.2) and Horizon Client…6.5
- CVE-2021-21989VMware Workstation (16.x prior to 16.1.2) and Horizon Client…6.5
Are you affected by CVE-2021-21983?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST