CVE-2021-21986

Published: May 26, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.

Vendor	Product	Versions
n/a	VMware vCenter Server and VMware Cloud Foundation	affected `VMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1, 3.x before 3.10.2.1)`

References

https://www.vmware.com/security/advisories/VMSA-2021-0010.html

x_refsource_MISC

http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-21986

Description

Affected Products

References