🔔VMSA-2021-0020🔔 vCenter Server Multiple Security Vulnerabilities

1. Etkilenen Ürünler

• VMware vCenter Server (vCenter Server)
• VMware Cloud Foundation (Cloud Foundation)

2. Giriş

• VMware vCenter Server'daki birden çok güvenlik açığı özel olarak VMware'e bildirildi. Etkilenen VMware ürünlerindeki bu güvenlik açıklarını gidermek için güncellemeler mevcuttur.

3a. vCenter Server file upload vulnerability (CVE-2021-22005)
3b. vCenter Server local privilege escalation vulnerability (CVE-2021-21991)
3c. vCenter Server reverse proxy bypass vulnerability (CVE-2021-22006)
3d. vCenter server unauthenticated API endpoint vulnerability (CVE-2021-22011)
3e. vCenter Server improper permission local privilege escalation vulnerabilities (CVE-2021-22015)
3f. vCenter Server unauthenticated API information disclosure vulnerability (CVE-2021-22012)
3g. vCenter Server file path traversal vulnerability (CVE-2021-22013)
3h. vCenter Server reflected XSS vulnerability (CVE-2021-22016)
3i. vCenter Server rhttpproxy bypass vulnerability (CVE-2021-22017)
3j. vCenter Server authenticated code execution vulnerability (CVE-2021-22014)
3k. vCenter Server file deletion vulnerability (CVE-2021-22018)
3l. vCenter Server XML parsing denial-of-service vulnerability (CVE-2021-21992)
3m. vCenter Server local information disclosure vulnerability (CVE-2021-22007)
3n. vCenter Server denial of service vulnerability (CVE-2021-22019)
3o. vCenter Server VAPI multiple denial of service vulnerabilities (CVE-2021-22009)
3p. vCenter Server VPXD denial of service vulnerability (CVE-2021-22010)
3q. vCenter Server information disclosure vulnerability (CVE-2021-22008)
3r. vCenter Server Analytics service denial-of-service Vulnerability (CVE-2021-22020)
3r. vCenter Server Analytics service denial-of-service Vulnerability (CVE-2021-22020)

4. Referans Linkler

vCenter Server 7.0 U2d
Downloads and Documentation:
https://customerconnect.vmware.com/d...974&rPId=74352
https://docs.vmware.com/en/VMware-vS...ase-notes.html


vCenter Server 6.7 U3o
Downloads and Documentation:
https://customerconnect.vmware.com/d...742&rPId=73667
https://docs.vmware.com/en/VMware-vS...ase-notes.html


vCenter Server 6.5 U3q
Downloads and Documentation:
https://customerconnect.vmware.com/d...614&rPId=74057
https://docs.vmware.com/en/VMware-vS...ase-notes.html


VMware vCloud Foundation 4.3.1
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Cl...ase-Notes.html


VMware vCloud Foundation 3.10.2.2
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Cl...ase-Notes.html


Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-21991
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-21992
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-21993
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22005
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22006
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22007
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22008
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22009
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22010
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22011
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22012
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22013
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22014
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22015
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22016
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22017
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22018
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22019
https://cve.mitre.org/cgi-bin/cvenam...CVE-2021-22020

FIRST CVSSv3 Calculator:
CVE-2021-21991: https://www.first.org/cvss/calculato...:C/C:H/I:H/A:H
CVE-2021-21992: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:H
CVE-2021-21993: https://www.first.org/cvss/calculato...:U/C:L/I:N/A:N
CVE-2021-22005: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22006: https://www.first.org/cvss/calculato...:C/C:L/I:L/A:L
CVE-2021-22007: https://www.first.org/cvss/calculato...:U/C:H/I:N/A:N
CVE-2021-22008: https://www.first.org/cvss/calculato...:U/C:L/I:N/A:N
CVE-2021-22009: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:L
CVE-2021-22010: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:L
CVE-2021-22011: https://www.first.org/cvss/calculato...:C/C:L/I:L/A:H
CVE-2021-22012: https://www.first.org/cvss/calculato...:U/C:H/I:N/A:N
CVE-2021-22013: https://www.first.org/cvss/calculato...:U/C:H/I:N/A:N
CVE-2021-22014: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22015: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22016: https://www.first.org/cvss/calculato...:U/C:H/I:H/A:H
CVE-2021-22017: https://www.first.org/cvss/calculato...:U/C:L/I:L/A:L
CVE-2021-22018: https://www.first.org/cvss/calculato...:U/C:N/I:L/A:L
CVE-2021-22019: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:L
CVE-2021-22020: https://www.first.org/cvss/calculato...:U/C:N/I:N/A:H

@odeaweb; @HostLAB; @PiEycPi; @Teknosos; @buyukweb; @Ozkula; @4Cloud; @Kapteyanteknoloji; @dehost;

Faydalı, teşekkürler.

Merhaba,

İlginiz ve bilgilendirmeniz için teşekkür ederiz.

Özellikle bu yıl vmware’ın üstüne çok gidiyorlar.

Merhaba,

Rica ederim. Hızlıca geçilmesi gereken bir fix. Vakit kaybetmeden fix geçmenizi tavsiye ederim.

Merhaba,

Kritik önem taşıyor. Düzeltmeleri hızlıca sağlıyoruz teşekkür ediyoruz.

Paylaşım için teşekkürler