VMSA-2021-0001

Important

Advisory ID: VMSA-2021-0001

CVSSv3 Range: 7.2

Issue Date: 2021-02-11

Updated On: 2021-02-11 (Initial Advisory)

CVE(s): CVE-2021-21976

Synopsis: vSphere Replication updates address a command injection vulnerability (CVE-2021-21976)

1. Impacted Products

vSphere Replication

2. Introduction

A command injection vulnerability in vSphere Replication was privately reported to VMware . Updates are available to address this vulnerability in the affected product.

3. Authenticated Command Injection Vulnerability in vSphere Replication(CVE-2021-21976)

Description

vSphere Replication contains a post-authentication command injection vulnerability in "Startup Configuration" page. VMware has evaluated this issue to be 'Important' severity with a maximum CVSSv3 base score of 7.2.

Known Attack Vectors

A malicious actor with administrative access in vSphere Replication can execute shell commands on the underlying system. Successful exploitation of this issue may allow authenticated admin user to perform a remote code execution.

Resolution

To remediate CVE-2021-21976, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Egor Dimitrenko from Positive Technologies for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
vSphere Replication	8.3.x	Any	CVE-2021-21976	7.2	important	8.3.1.2	None	None
vSphere Replication	8.2.x	Any	CVE-2021-21976	7.2	important	8.2.1.1	None	None
vSphere Replication	8.1.x	Any	CVE-2021-21976	7.2	important	8.1.2.3	None	None
vSphere Replication	6.5.x	Any	CVE-2021-21976	7.2	important	6.5.1.5	None	None