CVE-2021-21983

Description

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

From the Tenable Blog

CVE-2021-21975, CVE-2021-21983: Chained Vulnerabilities in VMware vRealize Operations Could Lead to Unauthenticated Remote Code Execution

Published: 2021-03-31

VMware has addressed a pair of vulnerabilities in vRealize Operations that, when chained together, could result in unauthenticated remote code execution in vulnerable servers.

References

https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective

https://www.tenable.com/blog/cve-2021-21975-cve-2021-21983-chained-vulnerabilities-in-vmware-vrealize-operations-could-lead

https://www.vmware.com/security/advisories/VMSA-2021-0004.html

http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3