Improper Authorization in VMware View Planner - CVE-2021-21978
Published: March 3, 2021 / Updated: October 18, 2021
Vulnerability identifier: #VU51179
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-21978
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authorization within the View Planner Harness feature in logupload web application. A remote non-authenticated attacker can upload and execute arbitrary file on the system.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code within the logupload container.
Affected software
VMware View Planner
How to mitigate CVE-2021-21978
Install updates from vendor's website.
VMware View Planner - update to 4.6 Security Patch 1
Links to Public Exploits and PoC-codes
- Exploit #6895 - CVE-2021-21978 (CVE-2021-21978 exp) (October 18, 2021)
- Exploit #5519 - CVE-2021-21978 (带回显版本的漏洞利用脚本) (June 2, 2021)
- Exploit #5494 - CVE-2021-21978 (CVE-2021-21978 EXP) (May 27, 2021)
- Exploit #5474 - CVE-2021-26855 (CVE-2021-26855 exp) (May 24, 2021)
- Exploit #5364 - VMware View Planner Unauthenticated Log File Upload RCE (May 9, 2021)