VMware addressed arbitrary file read and server-side request forgery (SSRF) vulnerabilities in its vCenter Server product.
VMware this week addressed arbitrary file read and server-side request forgery (SSRF) vulnerabilities affecting its vCenter Server product. vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location.
The first vulnerability, tracked as CVE-2021-21980, is a high severity arbitrary file read issue that affects the vSphere Web Client. An attacker with network access to port 443 on vCenter Server can exploit the flaw to obtain sensitive information.
“The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability” reads the advisory published by VMware. “A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.”
Another flaw, tracked as CVE-2021-22049, is a medium severity SSRF vulnerability that affects the vSphere Web Client.
“The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in.” continues the advisory. “A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.”
Organizations using the vCenter Server have to install the patches released by the virtualization giant as soon as possible.
Early September, VMware informed customers that it had started working on patches for a high-severity arbitrary file upload vulnerability, tracked as CVE-2021-22005, affecting vCenter Server.
At the end of September, a working exploit for the CVE-2021-22005 vulnerability was publicly released and attackers immediately started attempting to use it in the wild.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, vCenter Server)
[adrotate banner=”5″]
[adrotate banner=”13″]
