CVE-2021-22017
CVE-2021-22017 is a medium-severity vulnerability in Vmware Vcenter Server with a CVSS 3.x base score of 5.3. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-01-10).
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- CVSS v2: 5.0
- EPSS exploit prediction: 48% (99th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2022-01-10)
- EU (EUVD) id: EUVD-2021-9186
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2022-01-10)
- Affected product: Vmware Vcenter Server
- Published:
- Last modified:
Description
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Frequently asked questions
- What is CVE-2021-22017?
- Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
- How severe is CVE-2021-22017?
- CVE-2021-22017 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2021-22017 being actively exploited?
- Yes. CVE-2021-22017 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-01-10, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2021-22017?
- CVE-2021-22017 affects Vmware Vcenter Server. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-22017?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2021-22017 have an EU (EUVD) identifier?
- Yes. CVE-2021-22017 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-9186. It is also flagged as exploited in the EUVD (since 2022-01-10).
- When was CVE-2021-22017 published?
- CVE-2021-22017 was published on 2021-09-23 and last updated on 2026-06-17.
References
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22017
Affected products (1)
- cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*
More vulnerabilities in Vmware Vcenter Server
- CVE-2015-2342 — Critical (CVSS 10.0): The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not…
- CVE-2013-1405 — Critical (CVSS 10.0): VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client…
- CVE-2024-38812 — Critical (CVSS 9.8): The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious…
- CVE-2024-37080 — Critical (CVSS 9.8): vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor…
- CVE-2024-37079 — Critical (CVSS 9.8): vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor…
- CVE-2023-34048 — Critical (CVSS 9.8): vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious…