PT-2021-4331 · Vmware · Vmware Vcenter Server+1

George Noseevich + 2 · Published 2021-09-21 · Updated 2022-07-12 · CVE-2021-22007

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter Server (affected versions not specified)

Description The issue is related to insufficient access control in the Analytics service of VMware vCenter Server, allowing an authenticated user with non-administrative privileges to potentially exploit it and gain access to sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

BDU:2021-04955

CVE-2021-22007

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 7

• https://osv.dev/vulnerability/CVE-2021-22007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22007 · Security Note
• https://vmware.com/security/advisories/VMSA-2021-0020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04955 · Security Note
• https://t.me/cibsecurity/29281 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021092118 · Note
• https://dell.com/support/kbdoc/ru-ru/printview/000191991/10/en · Note