Security News > 2021 > February > VMWare Patches Critical RCE Flaw in vCenter Server

VMware has patched three vulnerabilities in its virtual-machine infrastructure for data centers, the most serious of which is a remote code execution flaw in its vCenter Server management platform.

The researcher found the most critical of the flaws, which is being tracked as CVE-2021-21972 and has a CVSS v3 score of 9.8, in a vCenter Server plugin for vROPs in the vSphere Client functionality, according to an advisory posted online Tuesday by VMware.

Klyuchnikov said the VMware flaw poses "No less threat" than a notoriously easy-to-exploit Citrix RCE vulnerability, CVE-2019-19781, which was discovered two years ago affecting more than 25,000 servers globally.

Another flaw patched by VMware in the update also has potential for remote code execution and affects the hypervisor VMware ESXi , the company said.

"The other flaw Klyuchnikov discovered-tracked as CVE-2021-21973 and the least serious of the three-is a Server Side Request Forgery vulnerability due to improper validation of URLs in a vCenter Server plugin with a CVSS score of 5.3, according to VMWare. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure," the company said.

Unauthorized users can use the flaw to send requests as the targeted server to help threat actors develop further attacks.

News URL

https://threatpost.com/vmware-patches-critical-rce-flaw-in-vcenter-server/164240/