CVE-2021-22015
First published: Thu Sep 23 2021(Updated: )
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Cloud Foundation | >=3.0<5.0 | |
| VMware vCenter Server | =6.5 | |
| VMware vCenter Server | =6.7 | |
| VMware vCenter Server | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for these local privilege escalation vulnerabilities in vCenter Server?
The vulnerability ID for these local privilege escalation vulnerabilities in vCenter Server is CVE-2021-22015.
What is the severity rating of CVE-2021-22015?
The severity rating of CVE-2021-22015 is high with a score of 7.8.
Which software versions are affected by CVE-2021-22015?
CVE-2021-22015 affects VMware Cloud Foundation versions 3.0 to 5.0, as well as VMware vCenter Server versions 6.5, 6.7, and 7.0.
How can an authenticated local user exploit CVE-2021-22015?
An authenticated local user with non-administrative privilege can exploit CVE-2021-22015 to elevate their privileges to root on vCenter Server Appliance.
Where can I find more information about CVE-2021-22015?
You can find more information about CVE-2021-22015 in the following references: [Packet Storm Security](http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.html) and [VMware Security Advisories](https://www.vmware.com/security/advisories/VMSA-2021-0020.html).
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/vmware
- canonical/vmware cloud foundation
- version/vmware cloud foundation/3.0
- canonical/vmware vcenter server
- version/vmware vcenter server/6.5
- version/vmware vcenter server/6.7
- version/vmware vcenter server/7.0