Description
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | VMware vCenter Server, VMware Cloud Foundation | VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- vCenter Server - Improper Access Control http/cves/2021/CVE-2021-22017.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.