CVE-2021-21993

Опубликовано: 23 сент. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.

Ссылки

https://www.vmware.com/security/advisories/VMSA-2021-0020.html
Patch
Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2021-0020.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 5.0 (исключая)

cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00237

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-p52h-5fjj-x2pc

github

больше 3 лет назад

BDU:2021-04984