Vulnerability identifier: #VU56795

Vulnerability risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-22006

CWE-ID: CWE-285

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
vCenter Server
Server applications / Virtualization software

Vendor: VMware, Inc

Description

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper URI handling in reverse proxy. A remote non-authenticate attacker can send a specially crafted HTTP request to port 443/TCP and access restricted endpoints.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

vCenter Server: 6.7 - 7.0.0

---

External links
http://www.vmware.com/security/advisories/VMSA-2021-0020.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.