CVE-2021-21993
Last modified
CVE-2021-21993 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.. EPSS estimates a 0.91% chance of exploitation in the next 30 days.
Description
The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Cloud Foundation | >= 3.0, < 5.0 |
| Vmware | Vcenter Server | 6.5 |
| Vmware | Vcenter Server | 6.7 |
| Vmware | Vcenter Server | 7.0 |
References
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-21993?
How severe is CVE-2021-21993?
How do I fix CVE-2021-21993?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-21988VMware Workstation (16.x prior to 16.1.2) and Horizon Client…6.5
- CVE-2021-21989VMware Workstation (16.x prior to 16.1.2) and Horizon Client…6.5
- CVE-2021-2199Vulnerability in the Oracle iStore product of Oracle E-Busin…8.2
- CVE-2021-21990VMware Workspace one UEM console (2102 prior to 21.2.0.8, 21…6.1
- CVE-2021-21991The vCenter Server contains a local privilege escalation vul…7.8
- CVE-2021-21992The vCenter Server contains a denial-of-service vulnerabilit…6.5
- CVE-2021-21994SFCB (Small Footprint CIM Broker) as used in ESXi has an aut…9.8
- CVE-2021-21995OpenSLP as used in ESXi has a denial-of-service vulnerabilit…7.5
- CVE-2021-21996An issue was discovered in SaltStack Salt before 3003.3. A u…7.5
- CVE-2021-21997VMware Tools for Windows (11.x.y prior to 11.3.0) contains a…5.5
- CVE-2021-21998VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8…9.8
- CVE-2021-21999VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Re…7.8
Are you affected by CVE-2021-21993?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST