URI Normalization Vulnerability in vCenter Server by VMware
CVE-2021-22017

5.3MEDIUM

Key Information:

Vendor
Vmware
Status
Vmware Vcenter Server, Vmware Cloud Foundation
Vendor
CVE Published:
23 September 2021

Badges

👾 Exploit Exists🦅 CISA Reported

Summary

A vulnerability exists within the Rhttproxy component of VMware's vCenter Server that arises from improper URI normalization. This flaw can be exploited by a malicious actor who has network access to port 443 on the vCenter Server. The attacker may leverage this vulnerability to bypass the proxy, consequently gaining unauthorized access to internal endpoints, which could lead to further exploitation or data leaks.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

VMware vCenter Server, VMware Cloud Foundation VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2

References

https://www.vmware.com/security/advisories/VMSA-2021-0020...
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.