CVE-2021-22005 is a critical arbitrary file upload vulnerability in the Analytics service of VMware vCenter Server and Cloud Foundation. An unauthenticated attacker with network access to port 443 can exploit this flaw to execute arbitrary code on the vCenter Server. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. It is actively exploited in the wild, including in known ransomware campaigns, with public Metasploit modules and Nuclei templates available. The vulnerability has garnered significant community attention and media coverage, highlighting its severe risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0, < 5.0CPE matchmatch criteria | cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | ||
6.5CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* | ||
6.7CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.