Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-21986
HistoryMay 26, 2021 - 3:15 p.m.

CVE-2021-21986

2021-05-2615:15:07
CWE-306
[email protected]
web.nvd.nist.gov
1

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

59.0%

JSON

The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.

Affected configurations

NVD
Node
vmwarevcenter_serverMatch6.5-
OR
vmwarevcenter_serverMatch6.5a
OR
vmwarevcenter_serverMatch6.5b
OR
vmwarevcenter_serverMatch6.5c
OR
vmwarevcenter_serverMatch6.5d
OR
vmwarevcenter_serverMatch6.5e
OR
vmwarevcenter_serverMatch6.5f
OR
vmwarevcenter_serverMatch6.5update1
OR
vmwarevcenter_serverMatch6.5update1b
OR
vmwarevcenter_serverMatch6.5update1c
OR
vmwarevcenter_serverMatch6.5update1d
OR
vmwarevcenter_serverMatch6.5update1e
OR
vmwarevcenter_serverMatch6.5update1g
OR
vmwarevcenter_serverMatch6.5update2
OR
vmwarevcenter_serverMatch6.5update2b
OR
vmwarevcenter_serverMatch6.5update2c
OR
vmwarevcenter_serverMatch6.5update2d
OR
vmwarevcenter_serverMatch6.5update2g
OR
vmwarevcenter_serverMatch6.5update3
OR
vmwarevcenter_serverMatch6.5update3d
OR
vmwarevcenter_serverMatch6.5update3f
OR
vmwarevcenter_serverMatch6.5update3k
OR
vmwarevcenter_serverMatch6.5update3n
OR
vmwarevcenter_serverMatch6.7-
OR
vmwarevcenter_serverMatch6.7a
OR
vmwarevcenter_serverMatch6.7b
OR
vmwarevcenter_serverMatch6.7d
OR
vmwarevcenter_serverMatch6.7update1
OR
vmwarevcenter_serverMatch6.7update1b
OR
vmwarevcenter_serverMatch6.7update2
OR
vmwarevcenter_serverMatch6.7update2a
OR
vmwarevcenter_serverMatch6.7update2c
OR
vmwarevcenter_serverMatch6.7update3
OR
vmwarevcenter_serverMatch6.7update3a
OR
vmwarevcenter_serverMatch6.7update3b
OR
vmwarevcenter_serverMatch6.7update3f
OR
vmwarevcenter_serverMatch6.7update3g
OR
vmwarevcenter_serverMatch6.7update3j
OR
vmwarevcenter_serverMatch6.7update3l
OR
vmwarevcenter_serverMatch6.7update3m
OR
vmwarevcenter_serverMatch7.0-
OR
vmwarevcenter_serverMatch7.0a
OR
vmwarevcenter_serverMatch7.0b
OR
vmwarevcenter_serverMatch7.0c
OR
vmwarevcenter_serverMatch7.0d
OR
vmwarevcenter_serverMatch7.0update1
OR
vmwarevcenter_serverMatch7.0update1a
OR
vmwarevcenter_serverMatch7.0update1c
OR
vmwarevcenter_serverMatch7.0update1d
OR
vmwarevcenter_serverMatch7.0update2
OR
vmwarevcenter_serverMatch7.0update2a
Node
vmwarecloud_foundationRange3.0–3.10.2.1
OR
vmwarecloud_foundationRange4.0–4.2.1

Related

cve 1
prion 1
cvelist 1
trellix 2
vmware 1
nessus 1
threatpost 1
thn 1
ibm 1
cve
cve
CVE-2021-21986
2021-05-26 15:15:07
prion
prion
Design/Logic Flaw
2021-05-26 15:15:00
cvelist
cvelist
CVE-2021-21986
2021-05-26 14:04:35
trellix
trellix
Are Virtual Machines the New Gold for Cyber Criminals?
2021-06-10 00:00:00
Are Virtual Machines the New Gold for Cyber Criminals?
2021-06-10 00:00:00
vmware
vmware
VMware vCenter Server updates address remote code execution and authentication vulnerabilities (CVE-2021-21985, CVE-2021-21986)
2021-05-25 00:00:00
nessus
nessus
VMware vCenter Server 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2021-0010)
2021-05-25 00:00:00
threatpost
threatpost
VMware Sounds Ransomware Alarm Over Critical Severity Bug
2021-05-26 19:45:50
thn
thn
Critical RCE Vulnerability Found in VMware vCenter Server — Patch Now!
2021-05-26 04:57:00
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in VMware vCenter affect IBM Cloud Pak System
2022-05-06 21:11:34

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

59.0%

JSON
Related for NVD:CVE-2021-21986
cve1prion1cvelist1trellix2vmware1nessus1threatpost1thn1ibm1