CVE-2021-22017
Vmware Vcenter Server 6.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2021-22017 is a medium-severity an unspecified weakness vulnerability in Vmware Vcenter Server. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. The affected component is the reverse proxy functionality within VMware vCenter Server, which listens on port 443. The issue received a CVSS v3.1 score of 5.3 and is tracked under NVD-CWE-noinfo.
A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass the proxy, leading to internal endpoints being accessed. The attack requires no authentication or user interaction and results in limited disclosure of information from otherwise protected resources.
The vulnerability is referenced in VMware security advisory VMSA-2021-0020 and appears in the CISA Known Exploited Vulnerabilities catalog, indicating confirmed real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-9186
Vulnerability Data
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being…
more
accessed.
- CWE(s)
- KEV Date Added
- 10 January 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.