CVE-2021-21983

MediumCVSS 6.5/10Last modified Aug 12, 2026

Description

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	VMware vRealize Operations	VMware vRealize Operations prior to 8.4

References

http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0004.htmlVendor Advisory
http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0004.htmlVendor Advisory

Timeline

Published: Mar 31, 2021
Last modified: Aug 12, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-219849.8VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A mal CVE-2021-219859.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check pl CVE-2021-219869.8The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, v CVE-2021-219876.5VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in th CVE-2021-219886.5VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in th CVE-2021-219896.5VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in th CVE-2021-21998.2Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 1 CVE-2021-219906.1VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 p CVE-2021-219917.8The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-CVE-2021-219926.5The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative CVE-2021-219936.5The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content CVE-2021-219949.8SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port