« Volver al listado

CVE-2021-21998

Estado: ModificadaCrítica (9.8)—

VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Carbon Black APP Control

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21998",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Carbon Black App Control (AppC)",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-23T12:15:07.857",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate."
    },
    {
      "lang": "es",
      "value": "VMware Carbon Black App Control versiones 8.0, 8.1, 8.5 anteriores a 8.5.8 y versiones 8.6 anteriores a 8.6.2, presenta una omisión de autenticación. Un actor malicioso con acceso de red al servidor de administración de VMware Carbon Black App Control podría obtener acceso administrativo al producto sin necesidad de autenticarse"
    }
  ],
  "lastModified": "2026-06-17T03:36:31.723",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC7CE59E-6DDC-4961-B730-807CCC8C779D",
              "versionEndExcluding": "8.5.8",
              "versionStartIncluding": "8.5"
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A144DAE2-DD1A-4C87-84DB-AA8DDED0A54D",
              "versionEndExcluding": "8.6.2",
              "versionStartIncluding": "8.6"
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "087EF879-DC09-45C0-844E-2DCC43A57A7E"
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94C16231-F798-4566-B56C-F3FD6B804C98"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}