CVE-2021-21983
Estado: ModificadaMedia (6.5)—
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 69%
- Percentil entre todas las CVEs puntuadas: 99
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- NVD-CWE-noinfo
Referencias
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
- https://www.vmware.com/security/advisories/VMSA-2021-0004.html
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
- https://www.vmware.com/security/advisories/VMSA-2021-0004.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-21983",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-21983",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2021-03-31T00:00:00+00:00"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 8.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 9.2,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "NONE"
},
"impactScore": 5.2,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "security@vmware.com",
"affectedData": [
{
"vendor": "n/a",
"product": "VMware vRealize Operations",
"versions": [
{
"status": "affected",
"version": "VMware vRealize Operations prior to 8.4"
}
]
}
]
}
],
"published": "2021-03-31T18:15:14.723",
"references": [
{
"url": "http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "security@vmware.com"
},
{
"url": "https://www.vmware.com/security/advisories/VMSA-2021-0004.html",
"tags": [
"Vendor Advisory"
],
"source": "security@vmware.com"
},
{
"url": "http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.vmware.com/security/advisories/VMSA-2021-0004.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system."
},
{
"lang": "es",
"value": "La vulnerabilidad de escritura arbitraria de archivos en la API vRealize Operations Manager (CVE-2021-21983) anterior a la versión 8.4, puede permitir que un actor malicioso autenticado con acceso de red para la API vRealize Operations Manager pueda escribir archivos en ubicaciones arbitrarias en el sistema operativo photon subyacente."
}
],
"lastModified": "2026-08-12T05:17:36.347",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BEACD8D-30EF-44FE-839B-DA69E6CED23A"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36847AD6-88CC-4228-AB4E-5161B381267C"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.0.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FC3C214-DEFC-48D9-8728-31F19095375E"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BF5CF56-8DE1-42F5-9EC1-E5666DD7FA59"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36668618-33C3-460A-879B-A9741405C9D0"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8266FD66-3BB6-4720-9D9F-06EFB38FA4B6"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D4C25D3-BC49-4727-B7A2-28C0F2E647EC"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E9AB6FF-D508-42FF-8FB9-24B96AE2F03F"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "328785AE-390C-4CA2-9771-4A26387E4E3E"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "298B797F-C3B6-445C-AADB-8633B446F10F"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F97BA12F-A60D-4398-9CA8-DE2F7BACBA8D"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E19009EB-02D3-424A-947D-7B66EFCCE422"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:3.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89656A51-0840-4A27-B05B-7E54B0CF0521"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38EB0C0C-56CF-4A8F-A36F-E0E180B9059E"
},
{
"criteria": "cpe:2.3:a:vmware:cloud_foundation:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A54544F5-5929-4609-A91C-FCA0FDBFE862"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:7.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7985EA2-E167-4BB9-91CA-D57110413B63"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:7.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BC6471F-2FB5-4C7A-9B5D-0B08A8E2C08C"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:8.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5F35204-5A57-4086-B782-77A25471F9EA"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:8.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "536C689B-F40A-4090-B7F9-3D16C6B2A82C"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:8.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76A32960-1C18-4DA5-A870-C15C432B6CE3"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:8.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4FCFFA39-F7EA-4065-B0B5-A1E2B120EBA0"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:8.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B612FDA-4210-44FE-9B5C-F678EA2CD6FD"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_operations_manager:8.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0256D20-63D3-4DE9-9637-94033F11FC7C"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3318D91-40AC-4649-8FCD-4557C8F934B9"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A06C29AB-1EAF-43EF-96C3-9E3468911B2F"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43723EC2-295E-4AF7-B654-70F9E42F4807"
},
{
"criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFB84C30-EE5D-4C15-A74E-7B2B3E0DED4D"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@vmware.com"
}