CVE-2021-22049

CVSS 3.1: 9.8 critical
EPSS: 2%p75
Published: Nov 24, 2021 · Nov 24, 2021
Modified: Jun 17, 2026

Analyze CVE-2021-22049 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

Vendors: vmware

Products: vcenter server

Weakness: CWE-918

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news

1 story

VMware addresses File Read and SSRF flaws in vCenter Server

Security AffairsNov 24, 20:17 UTC · Nov 24, 2021Exploit / PoCCVE-2021-21980 CVE-2021-22049 CVE-2021-220055 · 2 reads