CVE-2021-22017: VMware vCenter Server Improper Access Control
First published: Thu Sep 23 2021(Updated: )
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware vCenter Server | =6.7 | |
| VMware vCenter Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2021-22017.
What is the title of this vulnerability?
The title of this vulnerability is 'VMware vCenter Server Improper Access Control'.
What is the description of this vulnerability?
The vulnerability in vCenter Server allows a malicious actor to bypass proxy and access internal endpoints due to improper implementation of URI normalization.
What software is affected by this vulnerability?
vCenter Server version 6.7 is affected by this vulnerability.
What is the severity of CVE-2021-22017?
The severity of CVE-2021-22017 is medium with a CVSS score of 5.3.
How can I fix this vulnerability in VMware vCenter Server?
To fix this vulnerability, apply the necessary patches and updates provided by VMware. Refer to the VMware Security Advisory VMSA-2021-0020 for more information.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- collector/nvd-index
- vendor/vmware
- canonical/vmware vcenter server
- version/vmware vcenter server/6.7