CVE-2021-21973
24.02.2021, 17:15
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud_foundation | 3.0 ≤ 𝑥 < 3.10.1.2 |
| vmware | cloud_foundation | 4.0 ≤ 𝑥 < 4.2 |
| vmware | vcenter_server | 6.5 |
| vmware | vcenter_server | 6.5:a |
| vmware | vcenter_server | 6.5:b |
| vmware | vcenter_server | 6.5:c |
| vmware | vcenter_server | 6.5:d |
| vmware | vcenter_server | 6.5:e |
| vmware | vcenter_server | 6.5:f |
| vmware | vcenter_server | 6.5:update1d |
| vmware | vcenter_server | 6.5:update1e |
| vmware | vcenter_server | 6.5:update1g |
| vmware | vcenter_server | 6.5:update2 |
| vmware | vcenter_server | 6.5:update2b |
| vmware | vcenter_server | 6.5:update2c |
| vmware | vcenter_server | 6.5:update2d |
| vmware | vcenter_server | 6.5:update2g |
| vmware | vcenter_server | 6.5:update3 |
| vmware | vcenter_server | 6.5:update3d |
| vmware | vcenter_server | 6.5:update3f |
| vmware | vcenter_server | 6.5:update3k |
| vmware | vcenter_server | 6.7 |
| vmware | vcenter_server | 6.7:a |
| vmware | vcenter_server | 6.7:b |
| vmware | vcenter_server | 6.7:d |
| vmware | vcenter_server | 6.7:update1 |
| vmware | vcenter_server | 6.7:update1b |
| vmware | vcenter_server | 6.7:update2 |
| vmware | vcenter_server | 6.7:update2a |
| vmware | vcenter_server | 6.7:update2c |
| vmware | vcenter_server | 6.7:update3 |
| vmware | vcenter_server | 6.7:update3a |
| vmware | vcenter_server | 6.7:update3b |
| vmware | vcenter_server | 6.7:update3f |
| vmware | vcenter_server | 6.7:update3g |
| vmware | vcenter_server | 6.7:update3j |
| vmware | vcenter_server | 7.0 |
| vmware | vcenter_server | 7.0:a |
| vmware | vcenter_server | 7.0:b |
| vmware | vcenter_server | 7.0:c |
| vmware | vcenter_server | 7.0:d |
| vmware | vcenter_server | 7.0:update1 |
| vmware | vcenter_server | 7.0:update1a |
𝑥
= Vulnerable software versions