CVE-2021-21992: Medium severity vmware vcenter server and cloud foundation vulnerability
The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21992?
CVE-2021-21992 is a denial-of-service vulnerability in the vCenter Server due to improper XML entity parsing.
How does CVE-2021-21992 affect VMware products?
CVE-2021-21992 affects VMware Cloud Foundation and VMware vCenter Server versions 6.5, 6.7, and 7.0.
What is the severity of CVE-2021-21992?
The severity of CVE-2021-21992 is medium with a CVSS score of 6.5.
Who can exploit CVE-2021-21992?
A malicious actor with non-administrative user access to the vCenter Server vSphere Client or vCenter Server vSphere Web Client can exploit CVE-2021-21992.
How can CVE-2021-21992 be fixed?
VMware has released patches and recommends upgrading to the fixed versions mentioned in the advisory (https://www.vmware.com/security/advisories/VMSA-2021-0020.html).