Exploit / PoChigh

VMware addresses File Read and SSRF flaws in vCenter Server

Security Affairsby @securityaffairsNov 24, 2021 · 20:17 UTC (Nov 24, 2021)1 min read5 · 2 reads

Read at securityaffairs.com

Analyze CVE-2021-21980 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2021-21980 CVE-2021-22049 CVE-2021-22005

Tags: cve-2021-21980 cve-2021-22049 cve-2021-22005 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-21980	The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability	7.5	5%		Nov 24, 2021
CVE-2021-22005	Path Traversal File Upload RCE in VMware vCenter Server (Analytics Service)	9.8	100%	KEVRansomwarePoC	Sep 23, 2021 KEV Nov 3, 2021
CVE-2021-22049	The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in	9.8	2%		Nov 24, 2021

From the original article

1 min read at securityaffairs.com

VMware addressed arbitrary file read and server-side request forgery (SSRF) vulnerabilities in its vCenter Server product. VMware this week addressed arbitrary file read and server-side request forgery (SSRF) vulnerabilities affecting its vCenter Server product.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.