CVE-2021-21975

KEV · Ransomware

VMware Server Side Request Forgery in vRealize Operations Manager API

Vendor / Project: VMware
Product: vRealize Operations Manager API
Date added: Jan 18, 2022
Due date: Feb 1, 2022
Known ransomware use: Known
CWEs: CWE-918

Description

Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-21975