Server-Side Request Forgery (SSRF) in vCenter Server - CVE-2021-21993

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU56793

Server-Side Request Forgery (SSRF) in vCenter Server - CVE-2021-21993

Published: September 21, 2021


Vulnerability identifier: #VU56793
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2021-21993
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


Affected software

vCenter Server
Dell Enterprise Hybrid Cloud
EMC Integrated Data Protection Appliance
IBM Cloud Pak System
Cloud Foundation
Dell EMC VxRail Appliance

How to mitigate CVE-2021-21993

Install updates from vendor's website.

vCenter Server - addressed in versions 6.5 U3q, 6.7 U3o, 7.0 U2c
EMC Integrated Data Protection Appliance - update to 2.7.0
IBM Cloud Pak System - update to 2.3.3.4
Cloud Foundation - update to 3.10.2.2
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.463, 4.7.536, 7.0.241

External References

Related Security Bulletins