CISA confirmó el 07.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 21.03.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-21973
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| — | VMware Cloud Foundation | 4.x before 4.2, 3.x before 3.10.1.2 | |
| — | VMware vCenter Server | 7.x before 7.0 U1c, 6.7 before 6.7 U3l, 6.5 before 6.5 U3n | |
| vmware | cloud foundation | 3.0 – < 3.10.1.2 | |
| vmware | vcenter server | 6.5 |
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* ≥ 3.0 < 3.10.1.2cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* ≥ 4.0 < 4.2cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.