CVE-2021-22006

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

VendorProductVersions
n/aVMware vCenter Server, VMware Cloud FoundationVMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2)

References

Timeline

Published
Sep 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-220075.5The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administraCVE-2021-220087.5The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to CVE-2021-220097.5The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access CVE-2021-22014.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.23 anCVE-2021-220107.5The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter CVE-2021-220115.3vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network acceCVE-2021-220127.5The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wiCVE-2021-220137.5The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicioCVE-2021-220147.2The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authentiCVE-2021-220157.8The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An autCVE-2021-220166.1The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit thisCVE-2021-220175.3Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with net
CVE-2021-22006: High severity, CVSS 7.5 | Vulnix