Evil-DB LogoEvil-DB
← All CVEs

CVE-2021-21983

medium · 6.5

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

6.5
CVSS
68.6%
EPSS (exploit prob.)
99th
EPSS percentile
2021-03-31
Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Affected products

VendorProductAffected versions
vmwarecloud_foundation3.0
vmwarecloud_foundation3.0.1
vmwarecloud_foundation3.0.1.1
vmwarecloud_foundation3.5
vmwarecloud_foundation3.5.1
vmwarecloud_foundation3.7
vmwarecloud_foundation3.7.1
vmwarecloud_foundation3.7.2
vmwarecloud_foundation3.8
vmwarecloud_foundation3.8.1
vmwarecloud_foundation3.9
vmwarecloud_foundation3.9.1
vmwarecloud_foundation3.10
vmwarecloud_foundation4.0
vmwarecloud_foundation4.0.1
vmwarevrealize_operations_manager7.0.0
vmwarevrealize_operations_manager7.5.0
vmwarevrealize_operations_manager8.0.0
vmwarevrealize_operations_manager8.0.1
vmwarevrealize_operations_manager8.1.0
vmwarevrealize_operations_manager8.1.1
vmwarevrealize_operations_manager8.2.0
vmwarevrealize_operations_manager8.3.0
vmwarevrealize_suite_lifecycle_manager8.0
vmwarevrealize_suite_lifecycle_manager8.0.1
vmwarevrealize_suite_lifecycle_manager8.1
vmwarevrealize_suite_lifecycle_manager8.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-21983