CVE-2021-22025

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/aVMware vRealize OperationsVMware vRealize Operations (8.x prior to 8.5)

References

Timeline

Published
Aug 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-220267.5The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious CVE-2021-220277.5The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious CVE-2021-220289.1In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to infCVE-2021-220297.5VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session coCVE-2021-22034.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 anCVE-2021-220306.5In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) infoCVE-2021-220332.7Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.CVE-2021-220347.5Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.CVE-2021-220354.3VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics exportCVE-2021-220366.5VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor maCVE-2021-220377.8Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the coCVE-2021-220388.8On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller ex