CVE-2021-21975criticalunder attackransomwareCWE-918

CVE-2021-21975: critical vulnerability in VMware vRealize Operations

Published · Updated

Follow this CVE+ Monitor vRealize Operations+ Monitor vRealize Operations Manager API

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 78%
from disclosure to weaponsame day
Published on NVDMar 31
1st PoCMar 31
metasploitMar 30
CISA KEV+293d
Action required by CISAfederal deadline: 2022-02-01

Apply updates per vendor instructions.

In short

A flaw in vRealize Operations Manager's API allows attackers with network access to make the server itself perform requests to internal systems, potentially stealing admin credentials. This matters because it bypasses normal security controls by exploiting the server's trusted position.

Technical detail

A Server Side Request Forgery (SSRF) vulnerability in vRealize Operations Manager API prior to version 8.4 permits unauthenticated or low-privileged network-accessible attackers to forge requests from the server to internal resources, enabling credential theft and lateral movement. The vulnerability stems from insufficient validation of user-supplied URLs in API parameters.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware vRealize Operations
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.