CVE-2021-21998

critical · 9.8

VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.

9.8

CVSS

10.6%

EPSS (exploit prob.)

96th

EPSS percentile

2021-06-23

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
vmware	carbon_black_app_control	>= 8.5, < 8.5.8
vmware	carbon_black_app_control	>= 8.6, < 8.6.2
vmware	carbon_black_app_control	8.0
vmware	carbon_black_app_control	8.1

Check a specific version with /api/v1/cve/match.

References

https://www.vmware.com/security/advisories/VMSA-2021-0012.html?
https://www.vmware.com/security/advisories/VMSA-2021-0012.html?

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-21998