CVE-2021-22014 — Vmware Vcenter Server vulnerability

4 documents4 sources
Severity
7.2HIGHNVD
EPSS
1.2%
top 21.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Vmware Cloud FoundationVmware Vcenter Server
Timeline
PublishedSep 23
Latest updateMay 24

Description

The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDvmware/vcenter_server6.5, 6.7, 7.0+2
▶NVDvmware/cloud_foundation3.0 — 5.0

Patches

Patch: www.vmware.com ↗Patch: www.vmware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-438g-9pr9-j76p: The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure)↗2022-05-24
▶
CVEList
CVE-2021-22014: The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure)↗2021-09-23
▶

📋Vendor Advisories

1
VMware
VMware vCenter Server updates address multiple security vulnerabilities↗2021-09-21
▶
CVE-2021-22014 — Vmware Vcenter Server vulnerability | cvebase