CVE-2021-21999

Katalog CVE

CVSS 7.8 · High EPSS 1,5%

Kerentanan Uncontrolled Search Path Element pada vmware app volumes, vmware remote console +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain a local privilege escalation vulnerability. An attacker with normal access to a virtual machine may exploit this issue by placing a malicious file renamed as `openssl.cnf' in an unrestricted directory which would allow code to be executed with elevated privileges.

Rincian

Terbit di NVD

23 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vmware.com/security/advisories/VMSA-2021-0013.html patch · advisory vendor
• https://www.zerodayinitiative.com/advisories/ZDI-21-754/ advisory pihak ketiga · vdb entry