CVE-2021-21980

CVSS 3.1: 7.5 high
EPSS: 5%p91
Published: Nov 24, 2021 · Nov 24, 2021
Modified: Jun 17, 2026

Analyze CVE-2021-21980 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

Vendors: vmware

Products: cloud foundation, vcenter server

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (4.6%)

In the news

3 stories

Network Security Trends: November 2021 to January 2022

Palo Alto Unit 42Jun 5, 20:41 UTC · Jun 5, 2024Exploit / PoCExploitedCVE-2021-44228 CVE-2021-45046 CVE-2021-38647+133 · 1 read

VMware addresses File Read and SSRF flaws in vCenter Server

Security AffairsNov 24, 20:17 UTC · Nov 24, 2021Exploit / PoCCVE-2021-21980 CVE-2021-22049 CVE-2021-220055 · 2 reads

VMware Warns of Newly Discovered Vulnerabilities in vSphere Web Client

The Hacker NewsNov 25, 05:09 UTC · Nov 25, 2021VulnerabilityCVE-2021-219802 · 1 read