CVE-2021-22012

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	VMware vCenter Server	VMware vCenter Server 6.5 before 6.5 U3q

References

https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory

Timeline

Published: Sep 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-220137.5The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicio CVE-2021-220147.2The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenti CVE-2021-220157.8The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An aut CVE-2021-220166.1The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this CVE-2021-220175.3Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with net CVE-2021-220186.5The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with CVE-2021-220197.5The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5 CVE-2021-22026.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 CVE-2021-220205.5The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an a CVE-2021-220215.4VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An CVE-2021-220224.9The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative CVE-2021-220237.2The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative ac