Permissions, Privileges, and Access Controls in vCenter Server - CVE-2021-22018
Published: September 21, 2021
Vulnerability identifier: #VU56807
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22018
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to delete arbitrary files on the system.
The vulnerability exists due to improperly imposed security restrictions in a VMware vSphere Life-cycle Manager plug-in. A remote non-authenticated attacker can send a specially crafted request to port 9087/TCP and delete non critical files.
Affected software
vCenter Server
Dell Enterprise Hybrid Cloud
EMC Integrated Data Protection Appliance
Cloud Foundation
Dell EMC VxRail Appliance
Dell Enterprise Hybrid Cloud
EMC Integrated Data Protection Appliance
Cloud Foundation
Dell EMC VxRail Appliance
How to mitigate CVE-2021-22018
Install updates from vendor's website.
vCenter Server - update to 7.0 U2d
EMC Integrated Data Protection Appliance - update to 2.7.0
Cloud Foundation - update to 4.3.1
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.463, 4.7.536, 7.0.241
EMC Integrated Data Protection Appliance - update to 2.7.0
Cloud Foundation - update to 4.3.1
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.463, 4.7.536, 7.0.241
External References
Related Security Bulletins
- Multiple vulnerabilities in VMware vCenter Server
- Multiple vulnerabilities in VMware vCloud Foundation
- Multiple vulnerabilities in Dell EMC VxRail Appliance
- Dell EMC Enterprise Hybrid Cloud update for VMware products
- Multiple vulnerabilities in Dell EMC PowerProtect DP Series (Integrated Data Protection Appliance)