{
  "id": "CVE-2021-22013",
  "sourceIdentifier": "security@vmware.com",
  "published": "2021-09-23T12:15:08.083",
  "lastModified": "2021-09-27T14:24:28.133",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information."
    },
    {
      "lang": "es",
      "value": "vCenter Server contiene una vulnerabilidad de salto de ruta de archivos que conlleva a una divulgaci\u00f3n de informaci\u00f3n en la API de administraci\u00f3n de dispositivos. Un actor malicioso con acceso de red al puerto 443 de vCenter Server puede explotar este problema para conseguir acceso a informaci\u00f3n confidencial"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0",
              "versionEndExcluding": "5.0",
              "matchCriteriaId": "5071E0B4-FE4B-4525-BAF6-3900D9C8D48D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E456F84C-A86E-4EA9-9A3E-BEEA662136E6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "5FA81CCD-A05E-498C-820E-21980E92132F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0020.html",
      "source": "security@vmware.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}