Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access
VMware vRealize Operations before 8.4 is exposed to a Server Side Request Forgery flaw in its API, and 8.4.0 shipped with incomplete fixes. CVSS scores it 9.8 critical. Apply the Fixed Version updates in the advisory's Response Matrix.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
VMware vRealize Operations Manager, specifically its API in versions before 8.4, is affected by this vulnerability. An attacker with network access to the API could abuse it to forge server-side requests and steal administrative credentials.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a VMware vRealize Operations
VMware vRealize Operations prior to 8.4
References 2
Questions about CVE-2021-21975
What does this mean?
An attacker with network access can make the vRealize Operations Manager API perform Server Side Request Forgery requests. The advisory says this can be used to steal administrative credentials.Source: support.broadcom.com
Am I affected, and how do I check?
The advisory covers VMware vRealize Operations prior to 8.4. vRealize Operations Manager 8.4.0 is only partially affected because it shipped with incomplete fixes. To see which fixed version applies to a given deployment, compare its version against the Response Matrix in the advisory.Source: support.broadcom.com
What should I do about it?
Apply the updates listed in the 'Fixed Version' column of the Response Matrix to impacted deployments.Source: support.broadcom.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-18, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
No workaround is recorded for this CVE in the checked facts, so no interim step is listed while a fix is unavailable.Source: support.broadcom.com
Is the fix complete?
The advisory says vRealize Operations Manager 8.4.0 shipped with incomplete fixes and is therefore partially impacted. The checked facts do not say which part remains unfixed.Source: support.broadcom.com