Vulnerabilitycritical

VMware Warns of Critical File Upload Vulnerability Affecting vCenter Server

The Hacker Newsby @TheHackersNewsSep 22, 2021 · 03:22 UTC (Sep 22, 2021)2 min read7 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-22005 CVE-2021-21991 CVE-2021-22006 CVE-2021-22011 CVE-2021-22015 CVE-2021-22012 CVE-2021-22013 CVE-2021-22016 CVE-2021-22017 CVE-2021-22014 CVE-2021-22018 CVE-2021-21992 CVE-2021-22007 CVE-2021-22019 CVE-2021-22009 CVE-2021-22010 CVE-2021-22008 CVE-2021-22020 CVE-2021-21993

Tags: cve-2021-22005 cve-2021-21991 cve-2021-22006 cve-2021-22011 cve-2021-22015 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-21991 +1 related CVE CVE-2021-21992	The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens	7.8 group max	<1%		Sep 22, 2021
CVE-2021-22015 +14 related CVEs CVE-2021-22006 CVE-2021-22008 CVE-2021-22013 CVE-2021-22010 CVE-2021-22019 CVE-2021-22009 CVE-2021-22012 CVE-2021-22014 CVE-2021-22018 CVE-2021-21993 CVE-2021-22016 CVE-2021-22007+2 more	The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories	7.8 group max	2%	PoC	Sep 23, 2021
CVE-2021-22005 +1 related CVE CVE-2021-22017	Path Traversal File Upload RCE in VMware vCenter Server (Analytics Service)	9.8 group max	100%	KEVRansomwarePoC	Sep 23, 2021 KEV Nov 3, 2021

From the original article

2 min read at thehackernews.com

VMware on Tuesday published a new bulletin warning of as many as 19 vulnerabilities in vCenter Server and Cloud Foundation appliances that a remote attacker could exploit to take control of an affected system. The most urgent among them is an arbitrary file upload vulnerability in the Analytics service (CVE-2021-22005) that impacts vCenter Server 6. 7 and 7.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.