CVE-2021-21975: VMware Server Side Request Forgery in vRealize Operations Manager API

Vulnerability summary

CVE-2021-21975 is a critical (CVSS 9.8) Server-Side Request Forgery (SSRF) vulnerability in VMware vRealize Operations Manager API. It is known to be exploited: CISA lists it, first on 18-01-2022. It has been used in ransomware campaigns. EPSS estimates a 78.00% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 31-03-2021
   PublishedVulnerability first disclosed.
2. 18-01-2022
   Added to CISA KEVVMware Server Side Request Forgery in vRealize Operations Manager API
3. 01-02-2022
   CISA remediation dueApply updates per vendor instructions.
4. 01-10-2026
   Last modifiedVulnerability information updated.

Description

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.