CVE-2021-21973

Published: Feb 24, 2021Modified: Oct 30, 2025CISA KEV

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected (43)

Products: Vmware: Cloud Foundation, Vcenter Server

Vmware

2 products

Cloud Foundation

Vcenter Server

Configuration A

43 vulnerable

Vulnerable Software	Affected Versions
Vmware Cloud Foundation	From 3.0 to 3.10.1.2
Vmware Cloud Foundation	From 4.0 to 4.2
Vmware Vcenter Server	Version 6.5
Vmware Vcenter Server	Version 6.5 a
Vmware Vcenter Server	Version 6.5 b
Vmware Vcenter Server	Version 6.5 c
Vmware Vcenter Server	Version 6.5 d
Vmware Vcenter Server	Version 6.5 e
Vmware Vcenter Server	Version 6.5 f
Vmware Vcenter Server	Version 6.5 update1d
Vmware Vcenter Server	Version 6.5 update1e
Vmware Vcenter Server	Version 6.5 update1g
Vmware Vcenter Server	Version 6.5 update2
Vmware Vcenter Server	Version 6.5 update2b
Vmware Vcenter Server	Version 6.5 update2c
Vmware Vcenter Server	Version 6.5 update2d
Vmware Vcenter Server	Version 6.5 update2g
Vmware Vcenter Server	Version 6.5 update3
Vmware Vcenter Server	Version 6.5 update3d
Vmware Vcenter Server	Version 6.5 update3f
Vmware Vcenter Server	Version 6.5 update3k
Vmware Vcenter Server	Version 6.7
Vmware Vcenter Server	Version 6.7 a
Vmware Vcenter Server	Version 6.7 b
Vmware Vcenter Server	Version 6.7 d
Vmware Vcenter Server	Version 6.7 update1
Vmware Vcenter Server	Version 6.7 update1b
Vmware Vcenter Server	Version 6.7 update2
Vmware Vcenter Server	Version 6.7 update2a
Vmware Vcenter Server	Version 6.7 update2c
Vmware Vcenter Server	Version 6.7 update3
Vmware Vcenter Server	Version 6.7 update3a
Vmware Vcenter Server	Version 6.7 update3b
Vmware Vcenter Server	Version 6.7 update3f
Vmware Vcenter Server	Version 6.7 update3g
Vmware Vcenter Server	Version 6.7 update3j
Vmware Vcenter Server	Version 7.0
Vmware Vcenter Server	Version 7.0 a
Vmware Vcenter Server	Version 7.0 b
Vmware Vcenter Server	Version 7.0 c
Vmware Vcenter Server	Version 7.0 d
Vmware Vcenter Server	Version 7.0 update1
Vmware Vcenter Server	Version 7.0 update1a

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://www.vmware.com/security/advisories/VMSA-2021-0002.html

Source: security@vmware.com

Vendor Advisory

https://www.vmware.com/security/advisories/VMSA-2021-0002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.