Live › vulnerability › CVE-2021-21973
Go to dashboardVMware vCenter Server and Cloud Foundation contain a server-side request forgery flaw caused by improper URL validation in a vCenter plugin. An attacker can make the server send requests to internal hosts and read back the responses, which discloses information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware vCenter Server and Cloud Foundation | vendor | – | – |
Check the installed vCenter Server version against the VMware advisory for CVE-2021-21973 (VMSA-2021-0002).
Apply the VMware update for vCenter Server and Cloud Foundation per vendor instructions (CISA required action).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
This page as .md · .json · in your agent: get_signal("CVE-2021-21973")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.