{"id":"CVE-2021-21973","published":"2021-02-24T17:15:15Z","modified":"2026-06-17T03:36:28Z","title":"VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","vendor":"VMware","product":"vCenter Server and Cloud Foundation","tier":"core","eol":null,"description":{"text":"The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).","provenance":"source","from":"NVD"},"summary":{"text":"The vSphere Client (HTML5) in VMware vCenter Server and Cloud Foundation contains a Server-Side Request Forgery flaw caused by improper URL validation in a vCenter Server plugin. An attacker with network access to port 443 and no authentication or user interaction can send a crafted POST request to the plugin, leading to information disclosure.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:08Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.88012,"percentile":0.99764,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-07","dueDate":"2022-03-21","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21973","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-02-25","exploitedFirstSeen":"2021-02-25","ransomware":false,"evidence":[{"url":"https://outpost24.com/blog/attackers-collaborate-to-exploit-cve-2021-21972-and-cve-2021-21973/","date":"2021-02-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-07"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","date":"2025-03-11"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/05/08/inside-lockbit-defense-lessons-from-the-leaked-lockbit-negotiations","date":"2025-05-08"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0002.html","tags":["Vendor Advisory"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0002.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Server-Side Request Forgery (SSRF)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through an SSRF (Server Side Request Forgery) flaw in the vSphere Client (HTML5) of VMware's vCenter Server, affecting the vCenter Server plugin. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted POST request to the vCenter Server plugin, thereby bypassing URL validation. This manipulation enables the disclosure of sensitive information. By exploiting this flaw, attackers can scan the company's internal network and retrieve specifics about open ports and services.","confidence":"high"},{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Server-Side Request Forgery (SSRF)","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through an SSRF (Server Side Request Forgery) flaw in the vSphere Client (HTML5) of VMware's vCenter Server, affecting the vCenter Server plugin. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted POST request to the vCenter Server plugin, thereby bypassing URL validation. This manipulation enables the disclosure of sensitive information. By exploiting this flaw, attackers can scan the company's internal network and retrieve specifics about open ports and services.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9144","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9144","exploited":true,"exploitedSince":"2022-03-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-03-16","earliestUrl":"https://github.com/freakanonymous/CVE-2021-21973-Automateme","repos":[{"name":"freakanonymous/CVE-2021-21973-Automateme","url":"https://github.com/freakanonymous/CVE-2021-21973-Automateme","stars":1,"created":"2021-03-16"}]},"nuclei":[{"id":"CVE-2021-21973","name":"VMware vSphere - Server-Side Request Forgery","severity":"medium","path":"http/cves/2021/CVE-2021-21973.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21973.yaml"}],"first":{"date":"2021-03-16","source":"PoC-in-GitHub","url":"https://github.com/freakanonymous/CVE-2021-21973-Automateme"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1046"],"provenance":"source"}],"timeline":[{"date":"2021-02-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21973","provenance":"source"},{"date":"2021-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://outpost24.com/blog/attackers-collaborate-to-exploit-cve-2021-21972-and-cve-2021-21973/","provenance":"source"},{"date":"2021-03-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/freakanonymous/CVE-2021-21973-Automateme","provenance":"source"},{"date":"2022-03-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9144","provenance":"source"}],"speed":{"daysToPublicExploit":20,"firstExploitFrom":"PoC-in-GitHub","daysToKev":376},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2072 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9976"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}