CVE-2021-22015

The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.

Published: Sep 23, 2021
Updated: Apr 14, 2023
CVE: CVE-2021-22015
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-552

Affected Software
References

Software	From	Fixed in
vmware / vcenter_server	6.5	6.5.x
vmware / vcenter_server	6.7	6.7.x
vmware / vcenter_server	7.0	7.0.x
vmware / cloud_foundation	3.0	5.0

http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.html
https://www.vmware.com/security/advisories/VMSA-2021-0020.html

Vulnerability Database

CVE-2021-22015

Deep Security Visibility Without the Complexity