CVE-2021-21975

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi Dipakai ransomware EPSS 78,0%

Kerentanan Server-Side Request Forgery (SSRF) pada vmware cloud foundation, vmware vrealize operations manager +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 18 Januari 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Rincian

Terbit di NVD

31 Maret 2021

Terakhir diubah

2 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

78,0% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

VMware Server Side Request Forgery in vRealize Operations Manager API

Masuk KEV

18 Januari 2022

Tenggat CISA

1 Februari 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vmware.com/security/advisories/VMSA-2021-0004.html advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21975 pemerintah AS
• http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Cod... exploit · advisory pihak ketiga · vdb entry