CVE-2021-21973

KEV

VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability

Vendor / Project: VMware
Product: vCenter Server and Cloud Foundation
Date added: Mar 7, 2022
Due date: Mar 21, 2022
Known ransomware use: Unknown
CWEs: CWE-20, CWE-918

Description

VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-21973