NexaPulse
Subscribe
6.5mediumMedium

CVE-2021-21983

Vmware Cloud Foundation

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

Exploitation status

  • Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, an administrative account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
6.5 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Assigned by
security@vmware.com

Dates

Published
2021-03-31
Last modified
2026-08-12
Sources
NVD

Affected products

  • Vmware Cloud Foundation3.0, 3.0.1, 3.0.1.1, 3.5, 3.5.1, 3.7, 3.7.1, 3.7.2, 3.8, 3.8.1, 3.9, 3.9.1, 3.10, 4.0, 4.0.1
  • Vmware Vrealize Operations Manager7.0.0, 7.5.0, 8.0.0, 8.0.1, 8.1.0, 8.1.1, 8.2.0, 8.3.0
  • Vmware Vrealize Suite Lifecycle Manager8.0, 8.0.1, 8.1, 8.2

As listed in the NVD configuration data. Not a statement about your estate.

References