← CVE Radar
CVE-2021-21973VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
5.3 MEDIUMEPSS 88.01%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 5.3 | MEDIUM | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 5.0 | MEDIUM | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due Mar 21, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2021-21973
- Status
- Analyzed
- Assigner (CNA)
- vmware
- Published
- Feb 24, 2021
- Last modified
- 2026-06-17 03:36 UTC
Affected Products
As published by the CNA in the CVE record.
VMware vCenter Server3 version ranges
- 7.x before 7.0 U1c
- 6.7 before 6.7 U3l
- 6.5 before 6.5 U3n
VMware Cloud Foundation2 version ranges
- 4.x before 4.2
- 3.x before 3.10.1.2