CVE-2021-22017

VMware vCenter Server, VMware Cloud Foundation

Published 23 Sept 2021 · updated 17 Jun 2026 · Analyzed

5.3 Medium · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Jan 2022, with a remediation deadline of 24 Jan 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

References

www.vmware.com/security/advisories/VMSA-2021-0020.html · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22017 · US Government Resource