CVE-2021-21983

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

Affected

VMware vRealize Operations

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CVSS v2.0 NVD

8.5 HIGHAV:N/AC:L/Au:S/C:N/I:C/A:C

EPSS

68.77% chance of exploitation in the next 30 days, 99th percentile

Published

2021-03-31

Updated

2026-08-12

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Sid…
• murataydemir/CVE-2021-219833★ · 2022-03-16
• rabidwh0re/REALITY_SMASHER37★ · 2021-04-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrops_mgr_ssrf…

Security advisories

• https://www.vmware.com/security/advisories/VMSA-2021-0004.html

References

• CVE Record
• NVD entry

Related

• CVE-2016-2386
• CVE-2016-4014
• CVE-2017-9822
• CVE-2019-18935
• CVE-2020-0688
• CVE-2020-1472