CVE-2021-21975

Published: Mar 31, 2021Modified: Oct 30, 2025CISA KEV

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Affected (27)

Products: Vmware: Cloud Foundation, Vrealize Operations Manager, Vrealize Suite Lifecycle Manager

Vmware

3 products

Cloud Foundation

Vrealize Operations Manager

Vrealize Suite Lifecycle Manager

Configuration A

27 vulnerable

Vulnerable Software	Affected Versions
Vmware Cloud Foundation	Version 3.0.1.1
Vmware Cloud Foundation	Version 3.0.1
Vmware Cloud Foundation	Version 3.0
Vmware Cloud Foundation	Version 3.10
Vmware Cloud Foundation	Version 3.5.1
Vmware Cloud Foundation	Version 3.5
Vmware Cloud Foundation	Version 3.7.1
Vmware Cloud Foundation	Version 3.7.2
Vmware Cloud Foundation	Version 3.7
Vmware Cloud Foundation	Version 3.8.1
Vmware Cloud Foundation	Version 3.8
Vmware Cloud Foundation	Version 3.9.1
Vmware Cloud Foundation	Version 3.9
Vmware Cloud Foundation	Version 4.0.1
Vmware Cloud Foundation	Version 4.0
Vmware Vrealize Operations Manager	Version 7.0.0
Vmware Vrealize Operations Manager	Version 7.5.0
Vmware Vrealize Operations Manager	Version 8.0.0
Vmware Vrealize Operations Manager	Version 8.0.1
Vmware Vrealize Operations Manager	Version 8.1.0
Vmware Vrealize Operations Manager	Version 8.1.1
Vmware Vrealize Operations Manager	Version 8.2.0
Vmware Vrealize Operations Manager	Version 8.3.0
Vmware Vrealize Suite Lifecycle Manager	Version 8.0.1
Vmware Vrealize Suite Lifecycle Manager	Version 8.0
Vmware Vrealize Suite Lifecycle Manager	Version 8.1
Vmware Vrealize Suite Lifecycle Manager	Version 8.2