CVE-2021-22017 VMware vCenter Server Improper Access Control

What is CVE-2021-22017?

CVE-2021-22017 is a medium-severity vulnerability in Vmware Vcenter Server, published on 23 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

Which versions are affected by CVE-2021-22017?

It affects 1 product.

Products include Vmware Vcenter Server.

How do I fix CVE-2021-22017?

No fix has been published for CVE-2021-22017 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Jan 2022.

Is CVE-2021-22017 being exploited?

Yes. Attackers have exploited CVE-2021-22017 in the wild since at least 10 Jan 2022.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Vmware Vcenter Server

• CVE-2026-59310 Broadcom VMware vCenter Path Traversal Exploited Critical 9.8
• CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Exploited Critical 9.8
• CVE-2020-3952 VMware vCenter Server Information Disclosure Exploited Critical 9.8
• CVE-2015-2342 Code injection in n/a Critical 10.0
• CVE-2026-59309 vCenter authentication-bypass vulnerability Critical 9.8

All Vmware Vcenter Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w46j-w72r-9x98.