CVE-2021-22015

EPSS 1.8%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 1.8%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

21 Sep 2021Metasploit module available

23 Sep 2021Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.

Affected products

n/a · VMware vCenter Server, VMware Cloud Foundation

References

http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.html https://www.vmware.com/security/advisories/VMSA-2021-0020.html