Veille CVE
CVE-2021-21973
5.3 Moyenne Exploitée activementCatalogue CISA KEV — VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
Ajoutée le 07/03/2022 · Échéance de correction (agences US) : 21/03/2022
Action requise : Apply updates per vendor instructions.
Description
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 5.3 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | 5.3 Moyenne | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 2.0 | 5.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Faiblesses (CWE)
Références
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html Vendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973 US Government Resource