CVE-2021-22002

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-220037.5VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network accCVE-2021-220046.4An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf CVE-2021-220059.8The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 4CVE-2021-220067.5The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with networkCVE-2021-220075.5The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administraCVE-2021-220087.5The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to CVE-2021-220097.5The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access CVE-2021-22014.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.23 anCVE-2021-220107.5The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter CVE-2021-220115.3vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network acceCVE-2021-220127.5The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wiCVE-2021-220137.5The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicio
CVE-2021-22002: Critical severity, CVSS 9.8 | Vulnix