Exploited vulnerability · CISA KEV

Is CVE-2021-21975 exploited? Yes: in CISA KEV since 18 Jan 2022

Gociux · VMware vRealize Operations Manager API · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-21975, VMware Server Side Request Forgery in vRealize Operations Manager API, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 18 Jan 2022, 293 days after it was published. It is known to be used in ransomware campaigns. It affects VMware vRealize Operations Manager API. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.

What to do

1. Check whether you run it. Look for vRealize Operations Manager API in your asset inventory, including appliances and cloud images. Stack check lists every exploited VMware CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 31 Mar 2021.
4. Get told next time. Email alerts when CISA adds a CVE for VMware.

References

• nvd.nist.gov/vuln/detail/CVE-2021-21975

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in January 2022 · VMware scorecard · act-now radar.