CVE-2021-21973

CVE-2021-21973 is a medium-severity (CVSS 5.3) vulnerability in VMware vCenter Server and Cloud Foundation. CISA added it to the Known Exploited Vulnerabilities catalog on March 7, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 21, 2022. CISA does not currently list it as used in ransomware campaigns. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• https://www.vmware.com/security/advisories/VMSA-2021-0002.html
• https://www.vmware.com/security/advisories/VMSA-2021-0002.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973