High severity · published Mar 31, 2021
CVE-2021-21975
VMware Server Side Request Forgery in vRealize Operations Manager API
RansomwareIn wildKEV
7.5
CVSS
78%
EPSS
Yes
On KEV
Description
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)78.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 18, 2022
Federal remediation dueFeb 1, 2022
Ransomware campaign useKnown
Affected products
Which versions
VV
VMware vRealize Operations ·
VMware vRealize Operations prior to 8.4 · source: vendor
CF
Cloud Foundation · Vmware
3.0; 3.0.1; 3.0.1.1; 3.5; 3.5.1; 3.7; +9 more · source: NVD
VO
Vrealize Operations Manager · Vmware
7.0.0; 7.5.0; 8.0.0; 8.0.1; 8.1.0; 8.1.1; +2 more · source: NVD
VS
Vrealize Suite Lifecycle Manager · Vmware
8.0; 8.0.1; 8.1; 8.2 · source: NVD
VO
vRealize Operations Manager API · VMware
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21975
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21975
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.vmware.com/security/advisories/VMSA-2021-0004.html
x_refsource_MISC
http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
More from VMware vRealize Operations
8.8
CVE-2022-31673
VMware vRealize Operations contains an information disclosure vulnerability
7.5
CVE-2022-31675
VMware vRealize Operations contains an authentication bypass vulnerability
7.2
CVE-2022-31672
VMware vRealize Operations contains a privilege escalation vulnerability
4.3
CVE-2022-31674
VMware vRealize Operations contains an information disclosure vulnerability