CVE-2021-22006

The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.

Affected

VMware vCenter Server, VMware Cloud Foundation

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

6.61% chance of exploitation in the next 30 days, 94th percentile

Published

2021-09-23

Updated

2024-08-03

Proof-of-concept exploits (1)

• CrackerCat/CVE-2021-220063★ · 2023-01-30

Security advisories

• https://www.vmware.com/security/advisories/VMSA-2021-0020.html

References

• CVE Record
• NVD entry

Related

• CVE-2019-1096
• CVE-2019-2107
• CVE-2019-2215
• CVE-2020-0601
• CVE-2020-1020
• CVE-2020-11492