CVE-2021-21998

CWE-287 — Improper Authentication4 documents4 sources
Severity
9.8CRITICAL
EPSS
0.5%
top 34.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Vmware Carbon Black APP Control
Timeline
PublishedJun 23
Latest updateMay 24

Description

VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDvmware/carbon_black_app_control8.5 — 8.5.8+3
▶CVEListV5vmware_carbon_black_app_control_(appc)VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2

Patches

Patch: www.vmware.com ↗Patch: www.vmware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fp4q-hrv9-r6f5: VMware Carbon Black App Control 8↗2022-05-24
▶
CVEList
CVE-2021-21998: VMware Carbon Black App Control 8↗2021-06-23
▶

📋Vendor Advisories

1
VMware
VMware Carbon Black App Control update addresses authentication bypass (CVE-2021-21998)↗2021-06-22
▶