← Back

CVE-2021-21972

nvd nistnuclei
Published: Feb 24, 2021Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected (43)

Vmware
2 products
Cloud Foundation
Vcenter Server
Configuration A
43 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Cloud Foundation
From 3.0 to 3.10.1.2
Cloud Foundation
From 4.0 to 4.2
Vmware
Vcenter Server
Version 6.5
Vcenter Server
Version 6.5 a
Vcenter Server
Version 6.5 b
Vcenter Server
Version 6.5 c
Vcenter Server
Version 6.5 d
Vcenter Server
Version 6.5 e
Vcenter Server
Version 6.5 f
Vcenter Server
Version 6.5 update1d
Vcenter Server
Version 6.5 update1e
Vcenter Server
Version 6.5 update1g
Vcenter Server
Version 6.5 update2
Vcenter Server
Version 6.5 update2b
Vcenter Server
Version 6.5 update2c
Vcenter Server
Version 6.5 update2d
Vcenter Server
Version 6.5 update2g
Vcenter Server
Version 6.5 update3
Vcenter Server
Version 6.5 update3d
Vcenter Server
Version 6.5 update3f
Vcenter Server
Version 6.5 update3k
Vcenter Server
Version 6.7
Vcenter Server
Version 6.7 a
Vcenter Server
Version 6.7 b
Vcenter Server
Version 6.7 d
Vcenter Server
Version 6.7 update1
Vcenter Server
Version 6.7 update1b
Vcenter Server
Version 6.7 update2
Vcenter Server
Version 6.7 update2a
Vcenter Server
Version 6.7 update2c
Vcenter Server
Version 6.7 update3
Vcenter Server
Version 6.7 update3a
Vcenter Server
Version 6.7 update3b
Vcenter Server
Version 6.7 update3f
Vcenter Server
Version 6.7 update3g
Vcenter Server
Version 6.7 update3j
Vcenter Server
Version 7.0
Vcenter Server
Version 7.0 a
Vcenter Server
Version 7.0 b
Vcenter Server
Version 7.0 c
Vcenter Server
Version 7.0 d
Vcenter Server
Version 7.0 update1
Vcenter Server
Version 7.0 update1a

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (9)

Source: security@vmware.com
ExploitThird Party AdvisoryVDB Entry
Source: security@vmware.com
ExploitThird Party AdvisoryVDB Entry
Source: security@vmware.com
ExploitThird Party AdvisoryVDB Entry
Source: security@vmware.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.