QID 216271

Date Published: 2021-12-07

QID 216271: VMware vCenter Server 6.5 Update 6.5 U3R (VMSA-2021-0027)

VMware vCenter Server is a server management solution that helps IT admins manage virtualized hosts and virtual machines in enterprise environments via a single console.

CVE-2021-21980: The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.
CVE-2021-22049: The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.5.

Affected Versions:
VMware vCenter Server 6.5 prior to build 18711281

QID Detection Logic (Unauthenticated):
This QID checks for vulnerable versions of VMware vCenter Server with build version using web service present on the target.

A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service to gain access to sensitive information

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
  • Solution
    VMware has released patch for VMware vCenter Server 6.5 , visit VMware vCenter Server 6.5 Update 3R Release Notes

    Refer to VMware advisory VMSA-2021-0027 for more information.

    CVEs related to QID 216271

    Software Advisories
    Advisory ID Software Component Link
    VMware vCenter Server 6.5 U3R URL Logo docs.vmware.com/en/VMware-vSphere/6.5/rn/vsphere-vcenter-server-65u3r-release-notes.html