What’s Vulnerable › Vulnerabilities

CVE-2021-21973: VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-07
• EPSS: 88.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-24 · updated 2026-06-17
• Weakness: CWE-918

Description

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected products

• VMware Cloud Foundation: from 3.0 before 3.10.1.2; from 4.0 before 4.2 — fixed in 3.10.1.2, 4.2
• VMware vCenter Server: 6.5, 6.5-a, 6.5-b, 6.5-c, 6.5-d, 6.5-e (+35)
• VMware Cloud Foundation: 4.x before 4.2, 3.x before 3.10.1.2
• VMware vCenter Server: 7.x before 7.0 U1c, 6.7 before 6.7 U3l, 6.5 before 6.5 U3n

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 3.10.1.2, 4.2. Check the vendor advisory for mitigations.

References

• https://www.vmware.com/security/advisories/VMSA-2021-0002.html
• https://www.vmware.com/security/advisories/VMSA-2021-0002.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973

Get alerted when CVE-2021-21973 or the next vulnerability affects your stack