Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-21983

8 documents8 sources
Severity
6.5MEDIUM
EPSS
83.2%
top 0.73%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Vmware Cloud FoundationVmware Vrealize Operations ManagerVmware Vrealize Suite Lifecycle Manager
Timeline
PublishedMar 31
Latest updateMay 24

Description

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HExploitability: 1.2 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5vmware_vrealize_operationsVMware vRealize Operations prior to 8.4
▶NVDvmware/cloud_foundation15 versions+14

🔴Vulnerability Details

3
GHSA
GHSA-4vwx-r658-c2mg: Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8↗2022-05-24
▶
CVEList
CVE-2021-21983: Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8↗2021-03-31
▶
VulnCheck
vRealize Operations Manager API prior to 8.4 Unauthenticated File Write↗2021
▶

💥Exploits & PoCs

2
Metasploit
VMware vRealize Operations (vROps) Manager SSRF RCE↗
▶
Nuclei
vRealize Operations Manager API - Server-Side Request Forgery
▶

📋Vendor Advisories

1
VMware
VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)↗2021-03-30
▶
CVE-2021-21983 (MEDIUM CVSS 6.5) | Arbitrary file write vulnerability | cvebase.io