CVE-2021-21983

PoC —

CVSS 3.1

6.5 medium

EPSS

69%p99

Published

Mar 31, 2021 (Mar 31, 2021)

Modified

Aug 12, 2026

Description

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

Vendors: vmware
Products: cloud foundation, vrealize operations manager, vrealize suite lifecycle manager
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (68.6%)

In the news5 stories

Critical Auth Bypass Bug Found in VMware Data Center Security Product

The Hacker NewsApr 7, 09:38 UTC · Apr 7, 2021Vulnerability CVE-2021-21982 CVE-2021-21975 CVE-2021-21983

Week in review: PHP supply chain attack, common zero trust traps, hardening CI/CD pipelines

Help Net SecurityApr 4, 00:00 UTC · Apr 4, 2021Ransomware CVE-2021-21975 CVE-2021-21983

VMware fixed flaws in vROps that can be chained to compromise organizations

Security AffairsApr 1, 14:39 UTC · Apr 1, 2021Exploit / PoC CVE-2021-21975 CVE-2021-21983

VMware patches critical vRealize Operations flaws that could lead to RCE

Help Net SecurityApr 1, 00:00 UTC · Apr 1, 2021Vulnerability in the wildCVE-2021-21975 CVE-2021-21983

VMware addresses SSRF flaw in vRealize Operations that allows stealing admin credentials

Security AffairsMar 30, 19:59 UTC · Mar 30, 2021Vulnerability CVE-2021-21975 CVE-2021-21983