CVE-2021-21985

Scores

EPSS Score

0.9437

CVSS

3.x 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All CVSS Scores

CVSS 4.0

0.0

CVSS 3.x

9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0

10.0

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Sources

nvd

CWEs

CWE-20

Related Vulnerabilities

BDU:2021-02848

Exploits

Exploit ID: CVE-2021-21985

Source: github-poc

URL: https://github.com/sknux/CVE-2021-21985_PoC

Reference Links

http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html

http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html

https://www.vmware.com/security/advisories/VMSA-2021-0010.html

http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html

http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html

https://www.vmware.com/security/advisories/VMSA-2021-0010.html

Vulnerable Software

Type: Configuration

Vendor: vmware

Product: cloud_foundation

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "3.10.2.1",
      "versionStartIncluding": "3.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "4.2.1",
      "versionStartIncluding": "4.0",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: vmware

Product: vcenter_server

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd