Improper Authorization in VMware View Planner - CVE-2021-21978
Published: March 3, 2021 / Updated: October 18, 2021
Vulnerability identifier: #VU51179
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2021-21978
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: VMware, Inc
Affected software:
VMware View Planner
VMware View Planner
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authorization within the View Planner Harness feature in logupload web application. A remote non-authenticated attacker can upload and execute arbitrary file on the system.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code within the logupload container.
How to mitigate CVE-2021-21978
Install updates from vendor's website.