1. Etkilenen Ürünler

• VMware vCenter Server (vCenter Server)
• VMware Cloud Foundation (Cloud Foundation)

2. Giriş

• VMware vCenter Server'daki birden çok güvenlik açığı özel olarak VMware'e bildirildi. Etkilenen VMware ürünlerindeki bu güvenlik açıklarını gidermek için güncellemeler mevcuttur.

3a. vCenter Server file upload vulnerability (CVE-2021-22005)
3b. vCenter Server local privilege escalation vulnerability (CVE-2021-21991)
3c. vCenter Server reverse proxy bypass vulnerability (CVE-2021-22006)
3d. vCenter server unauthenticated API endpoint vulnerability (CVE-2021-22011)
3e. vCenter Server improper permission local privilege escalation vulnerabilities (CVE-2021-22015)
3f. vCenter Server unauthenticated API information disclosure vulnerability (CVE-2021-22012)
3g. vCenter Server file path traversal vulnerability (CVE-2021-22013)
3h. vCenter Server reflected XSS vulnerability (CVE-2021-22016)
3i. vCenter Server rhttpproxy bypass vulnerability (CVE-2021-22017)
3j. vCenter Server authenticated code execution vulnerability (CVE-2021-22014)
3k. vCenter Server file deletion vulnerability (CVE-2021-22018)
3l. vCenter Server XML parsing denial-of-service vulnerability (CVE-2021-21992)
3m. vCenter Server local information disclosure vulnerability (CVE-2021-22007)
3n. vCenter Server denial of service vulnerability (CVE-2021-22019)
3o. vCenter Server VAPI multiple denial of service vulnerabilities (CVE-2021-22009)
3p. vCenter Server VPXD denial of service vulnerability (CVE-2021-22010)
3q. vCenter Server information disclosure vulnerability (CVE-2021-22008)
3r. vCenter Server Analytics service denial-of-service Vulnerability (CVE-2021-22020)
3r. vCenter Server Analytics service denial-of-service Vulnerability (CVE-2021-22020)

4. Referans Linkler

vCenter Server 7.0 U2d
Downloads and Documentation:
https://customerconnect.vmware.com/d...974&rPId=74352
https://docs.vmware.com/en/VMware-vS...ase-notes.html


vCenter Server 6.7 U3o
Downloads and Documentation:
https://customerconnect.vmware.com/d...742&rPId=73667
https://docs.vmware.com/en/VMware-vS...ase-notes.html


vCenter Server 6.5 U3q
Downloads and Documentation:
https://customerconnect.vmware.com/d...614&rPId=74057
https://docs.vmware.com/en/VMware-vS...ase-notes.html


VMware vCloud Foundation 4.3.1
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Cl...ase-Notes.html


VMware vCloud Foundation 3.10.2.2
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Cl...ase-Notes.html


Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-21991
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-21992
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-21993
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22005
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22006
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22007
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22008
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22009
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22010
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22011
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22012
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22013
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22014
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22015
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22016
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22017
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22018
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22019
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22020

FIRST CVSSv3 Calculator:
CVE-2021-21991: https://www.first.org/cvss/calculato...:C/C:H/I:H/A:H
CVE-2021-21992: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:H
CVE-2021-21993: https://www.first.org/cvss/calculato...:U/C:L/I:N/A:N
CVE-2021-22005: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22006: https://www.first.org/cvss/calculato...:C/C:L/I:L/A:L
CVE-2021-22007: https://www.first.org/cvss/calculato...:U/C:H/I:N/A:N
CVE-2021-22008: https://www.first.org/cvss/calculato...:U/C:L/I:N/A:N
CVE-2021-22009: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:L
CVE-2021-22010: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:L
CVE-2021-22011: https://www.first.org/cvss/calculato...:C/C:L/I:L/A:H
CVE-2021-22012: https://www.first.org/cvss/calculato...:U/C:H/I:N/A:N
CVE-2021-22013: https://www.first.org/cvss/calculato...:U/C:H/I:N/A:N
CVE-2021-22014: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22015: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22016: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22017: https://www.first.org/cvss/calculato...:U/C:L/I:L/A:L
CVE-2021-22018: https://www.first.org/cvss/calculato...:U/C:N/I:L/A:L
CVE-2021-22019: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:L
CVE-2021-22020: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:H

@odeaweb; @HostLAB; @PiEycPi; @Teknosos; @buyukweb; @Ozkula; @4Cloud; @Kapteyanteknoloji; @dehost;