PT-2021-3449 · Vmware · Vmware Carbon Black App Control

Published 2021-06-22 · Updated 2021-06-30 · CVE-2021-21998

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Carbon Black App Control versions 8.0 through 8.1 VMware Carbon Black App Control versions 8.5 through 8.5.7 VMware Carbon Black App Control versions 8.6 through 8.6.1

Description The issue is related to authentication errors in the VMware Carbon Black App Control server. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.

Recommendations For versions 8.0 and 8.1, update to a version later than 8.1. For versions 8.5 through 8.5.7, update to version 8.5.8 or later. For versions 8.6 through 8.6.1, update to version 8.6.2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-03309

CVE-2021-21998

Affected Products

Vmware Carbon Black App Control

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-21998 · Security Note
• https://bdu.fstec.ru/vul/2021-03309 · Security Note
• https://vmware.com/security/advisories/VMSA-2021-0012.html? · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21998 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021062224 · Note
• https://t.me/cvenotify/16866 · Telegram Post
• https://vmware.com/security/advisories/VMSA-2021-0012.html · Note
• https://t.me/thehackernews/1312 · Telegram Post