CVE-2021-22011

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-220127.5The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wiCVE-2021-220137.5The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicioCVE-2021-220147.2The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authentiCVE-2021-220157.8The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An autCVE-2021-220166.1The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit thisCVE-2021-220175.3Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with netCVE-2021-220186.5The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with CVE-2021-220197.5The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5CVE-2021-22026.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 CVE-2021-220205.5The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an aCVE-2021-220215.4VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. AnCVE-2021-220224.9The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative
CVE-2021-22011: Medium severity, CVSS 5.3 | Vulnix