VMware releases patches for critical flaw in Carbon Black App Control
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21998 | VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate. NVD description · AI analysis pending | 9.8 | 11% |
| — |
Full article207 words · extracted from securityaffairs.com · click to collapse
VMware released security patches to address an authentication bypass vulnerability in VMware Carbon Black App Control (AppC) for Windows.
VMware released security patches for an authentication bypass vulnerability, tracked as CVE-2021-21998, in Carbon Black App Control (AppC) running on Windows machines.
Carbon Black App Control allows to lock down critical systems and servers to prevent unwanted changes and ensure continuous compliance with regulatory mandates.
An attacker could exploit the flaw to gain unauthenticated administrative access to the application.
“An authentication bypass in the VMware Carbon Black App Control management server was privately reported to VMware.” reads the security advisory published by the company. “A malicious actor with network access to the Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.”
The CVE-2021-21998 vulnerability has received a CVSSv3 base score of 9.4.
The company addressed the flaw with the release of Carbon Black App Control (AppC) 8.6.2 and 8.5.8, and a hotfix for the 8.1.x and 8.0.x versions of AppC.
The company informed its customers that there are no workarounds to mitigate this flaw.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, VMWare)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/119362/security/vmware-carbon-black-app-control-flaw.html