Design/Logic Flaw

2021-05-2615:15:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.0%

JSON

The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.

CPENameOperatorVersion
cloud_foundationge3.0
cloud_foundationlt3.10.2.1
cloud_foundationge4.0
cloud_foundationlt4.2.1
vcenter_servereq6.5 f
vcenter_servereq6.5 e
vcenter_servereq6.5 d
vcenter_servereq6.5 c
vcenter_servereq6.5 b
vcenter_servereq6.5 a

Name	Operator	Version
cloud_foundation	ge	3.0
cloud_foundation	lt	3.10.2.1
cloud_foundation	ge	4.0
cloud_foundation	lt	4.2.1
vcenter_server	eq	6.5 f
vcenter_server	eq	6.5 e
vcenter_server	eq	6.5 d
vcenter_server	eq	6.5 c
vcenter_server	eq	6.5 b
vcenter_server	eq	6.5 a