CVE-2021-22005
9.8CRITICALThe vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code
Publicado: 9/23/2021Atualizado: 10/30/2025
Vulnerabilidade Explorada Conhecida (CISA)
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Ação Necessária:
Apply updates per vendor instructions.
Prazo:
2021-11-17
Uso Conhecido de Ransomware
Descrição
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
Análise IADesenvolvido por IA
Produtos Afetados
vmwarecloud_foundation
vmwarevcenter_server
6.5
vmwarevcenter_server
6.7
vmwarevcenter_server
7.0
Referências
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlExploitThird Party AdvisoryVDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatchVendor Advisory
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlExploitThird Party AdvisoryVDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005US Government Resource