#VU51179 Improper Authorization in VMware View Planner - CVE-2021-21978
Published: March 3, 2021 / Updated: October 18, 2021
Vulnerability identifier: #VU51179
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2021-21978
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
VMware View Planner
VMware View Planner
Software vendor:
VMware, Inc
VMware, Inc
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authorization within the View Planner Harness feature in logupload web application. A remote non-authenticated attacker can upload and execute arbitrary file on the system.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code within the logupload container.
Remediation
Install updates from vendor's website.