CVE-2021-22015

Published: Sep 23, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.

Affected (4)

Products: Vmware: Cloud Foundation, Vcenter Server

2 products

Cloud Foundation

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Cloud Foundation	From 3.0 to 5.0
Vmware Vcenter Server	Version 6.5
Vmware Vcenter Server	Version 6.7
Vmware Vcenter Server	Version 7.0

Related CWEs

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (4)

http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.html

Source: security@vmware.com

ExploitThird Party AdvisoryVDB Entry

https://www.vmware.com/security/advisories/VMSA-2021-0020.html

Source: security@vmware.com

PatchVendor Advisory

http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.vmware.com/security/advisories/VMSA-2021-0020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.