PT-2021-4352 · Vmware · Vmware Vcenter Server+1

Hynek Petrak · Published 2021-09-21 · Updated 2022-07-12 · CVE-2021-21991

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server (affected versions not specified)

Description The issue is related to insufficient validation of session tokens in VMware vCenter Server, allowing a malicious actor with non-administrative user access on the vCenter Server host to exploit this issue and escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-04981

CVE-2021-21991

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-21991 · Security Note
• https://vmware.com/security/advisories/VMSA-2021-0020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04981 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21991 · Vendor Advisory
• https://t.me/cvenotify/21939 · Telegram Post
• https://t.me/cibsecurity/29246 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021092118 · Note
• https://dell.com/support/kbdoc/ru-ru/printview/000191991/10/en · Note