PT-2021-3068 · Vmware · Vmware Vrealize Business For Cloud

Egor Dimitrenko · Published 2021-05-05 · Updated 2021-05-17 · CVE-2021-21984

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vRealize Business for Cloud versions prior to 7.6.0

Description The issue is related to insufficient argument validation in a command, allowing a remote attacker to execute arbitrary commands on the target system. This can lead to unauthorized remote code execution on the vRealize Business for Cloud Virtual Appliance. A malicious actor with network access may exploit this issue.

Recommendations For versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoint to minimize the risk of exploitation.

Fix

Command Injection

Missing Authorization

Weakness Enumeration

CWE-77

CWE-862

Related Identifiers

BDU:2021-02680

CVE-2021-21984

Affected Products

Vmware Vrealize Business For Cloud

References · 6

• https://vmware.com/security/advisories/VMSA-2021-0007.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02680 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21984 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21984 · Vendor Advisory
• https://t.me/cvenotify/14247 · Telegram Post
• https://t.me/ptswarm/35 · Telegram Post