medium5.3Known exploited
CVE-2021-22017
VMware vCenter Server Improper Access Control
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-10. Federal due date: 2022-01-24.
Apply updates per vendor instructions.
Impact
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Vcenter Server | Version 6.7 |