CVE-2021-21973
MEDIUM KEV NUCLEIVmware Cloud Foundation < 3.10.1.2 - SSRF
Title source: ruleDescription
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Exploits (1)
nomisec
WORKING POC
1 stars
by freakanonymous · remote
https://github.com/freakanonymous/CVE-2021-21973-Automateme
Nuclei Templates (1)
VMware vSphere - Server-Side Request Forgery
MEDIUMby pdteam
Scores
CVSS v3
5.3
EPSS
0.9008
EPSS Percentile
99.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CISA KEV
2022-03-07
VulnCheck KEV
2021-02-25
InTheWild.io
2022-03-07
ENISA EUVD
EUVD-2021-9144
CWE
CWE-918
Status
published
Products (4)
vmware/cloud_foundation
3.0 - 3.10.1.2
vmware/vcenter_server
6.5 (19 CPE variants)
vmware/vcenter_server
6.7 (15 CPE variants)
vmware/vcenter_server
7.0 (7 CPE variants)
Published
Feb 24, 2021
KEV Added
Mar 07, 2022
Tracked Since
Feb 18, 2026