VMware published a new security advisory overnight (VMSA-2021-0020) and it’s a big one. In total, it lists 19 vulnerabilities affecting multiple versions of vCenter. The most serious of the vulnerabilities is the first one – CVE-2021-22005. This vulnerability allows an attacker to upload files to vCenter. This vulnerability could then be used as an avenue to execute code. It’s been giving a CVSS score of 9.8
The second most worrying item on the list (CVE-2021-21991) allows an attacker to escalate their priveleges to Administrator level in the vSphere web interface. This vulnerability has been scored at 8.8.
The resolution for all these vulnerabilities is to update vCenter to the appropriate version. The advistory lists these, and I’ve produced a condensed version below.
| Product/Version | Update To | Notes |
| vCenter 7.0 | 7.0 U2d | The majority of issues are fixed by going to U2c. U2d resolves CVE-2021-22011 and CVE-2021-22018 |
| vCenter 6.7 | 6.7 U3o | This version will resolve all the associated issues with 6.7 |
| vCenter 6.5 | 6.5 U3q | This version will resolve all the associated issues with 6.5 |
Given the nature of some of these vulnerabilities, this would be one to get onto ASAP.