CVE-2021-22014
First published: Thu Sep 23 2021(Updated: )
The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Cloud Foundation | >=3.0<5.0 | |
| VMware vCenter Server | =6.5 | |
| VMware vCenter Server | =6.7 | |
| VMware vCenter Server | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2021-22014?
CVE-2021-22014 is an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure) in vCenter Server.
How does CVE-2021-22014 affect VMware Cloud Foundation?
CVE-2021-22014 affects VMware Cloud Foundation versions 3.0 to 5.0, allowing an authenticated VAMI user with network access to execute code on the underlying operating system.
How does CVE-2021-22014 affect VMware vCenter Server 6.5?
CVE-2021-22014 affects VMware vCenter Server version 6.5, allowing an authenticated VAMI user with network access to execute code on the underlying operating system.
How does CVE-2021-22014 affect VMware vCenter Server 6.7?
CVE-2021-22014 affects VMware vCenter Server version 6.7, allowing an authenticated VAMI user with network access to execute code on the underlying operating system.
How does CVE-2021-22014 affect VMware vCenter Server 7.0?
CVE-2021-22014 affects VMware vCenter Server version 7.0, allowing an authenticated VAMI user with network access to execute code on the underlying operating system.
What is the severity of CVE-2021-22014?
CVE-2021-22014 has a severity rating of 7.2 (critical).
How can I fix CVE-2021-22014?
To fix CVE-2021-22014, apply the necessary security patches or updates provided by VMware.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/vmware
- canonical/vmware cloud foundation
- version/vmware cloud foundation/3.0
- canonical/vmware vcenter server
- version/vmware vcenter server/6.5
- version/vmware vcenter server/6.7
- version/vmware vcenter server/7.0