CVE-2021-22049

—

CVSS 3.1

9.8 critical

EPSS

2%p75

Published

Nov 24, 2021 (Nov 24, 2021)

Modified

Jun 17, 2026

Description

The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

Vendors: vmware
Products: vcenter server
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news1 stories

VMware addresses File Read and SSRF flaws in vCenter Server

Security AffairsNov 24, 20:17 UTC · Nov 24, 2021Exploit / PoC CVE-2021-21980 CVE-2021-22049 CVE-2021-22005