CVE-2021-22017 - Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization

Back Back to CVE browser

MEDIUM KEV

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization

Published Sep 23, 2021 ·Due Jan 24, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 49.18%

Description

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

Affected products

Vendor n/a Product VMware vCenter Server, VMware Cloud Foundation Default
n/a
- Version
  VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

VMware vCenter Server, VMware Cloud Foundation

n/a

Version	Status	Constraints
VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22017
government-resourceUS Government Resource
https://www.vmware.com/security/advisories/VMSA-2021-0020.html
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22017		government-resourceUS Government Resource
https://www.vmware.com/security/advisories/VMSA-2021-0020.html		x_refsource_MISCPatchVendor Advisory