VMSA-2021-0025.4

Main Menu

Take Control of Your Multi-Cloud Environment

73% of enterprises use two or more public clouds today. While multi-cloud accelerates digital transformation, it also introduces complexity and risk.

Simplicity Across Clouds Is Rare
91% of executives are looking to improve “consistency across [their] public cloud environments."

Applications Need to Be Modernized
68% of developers want to expand use of modern application frameworks, APIs and services.

Distributed Work Models Are Here to Stay
72% of enterprise employees are working from non-traditional environments.

Security Is a Top-Down Concern
Risk related to security, data and privacy issues remains the #1 multi-cloud challenge.

SEE HOW VMWARE CAN HELP

VMware Cross-Cloud™ services enable organizations to unlock the potential of multi-cloud with enterprise security and resiliency.

LEARN ABOUT CROSS-CLOUD SERVICES

Important

Advisory ID: VMSA-2021-0025.4

CVSSv3 Range: 7.1

Issue Date: 2021-11-10

Updated On: 2022-10-11

CVE(s): CVE-2021-22048

Synopsis: VMware vCenter Server updates address a privilege escalation vulnerability (CVE-2021-22048)

1. Impacted Products

VMware vCenter Server (vCenter Server)
VMware Cloud Foundation (Cloud Foundation)

2. Introduction

A privilege escalation vulnerability in VMware Center Server was privately reported to VMware. Workarounds are available to remediate this vulnerability in the affected VMware products.

3. VMware vCenter Server IWA privilege escalation vulnerability (CVE-2021-22048)

Description

The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.

Known Attack Vectors

A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.

Resolution

None.

Workarounds

Workaround for CVE-2021-22048 is to switch to AD over LDAPS authentication OR Identity Provider Federation for AD FS (vSphere 7.0 or later) from Integrated Windows Authentication (IWA) as documented in the KB listed in the 'Workarounds' column of the 'Response Matrix' below.

Additional Documentation

[1] VMware has determined that vCenter 7.0u3f updates previously mentioned in the response matrix do not remediate CVE-2021-22048 and may introduce a functional issue for customers using IWA. Please review KB89027 for more information.

Notes

None.

Acknowledgements

VMware would like to thank Yaron Zinar and Sagi Sheinfeld of Crowdstrike for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
vCenter Server	8.0	Any	CVE-2021-22048	7.1	important	Patch Pending	KB86292	None
vCenter Server	7.0	Any	CVE-2021-22048	7.1	important	Patch Pending [1]	KB86292	KB89027 [1]
vCenter Server	6.7	Any	CVE-2021-22048	7.1	important	Patch Pending	KB86292	None
vCenter Server	6.5	Any	CVE-2021-22048	7.1	important	Patch Pending	KB86292	None

Impacted Product Suites that Deploy Response Matrix Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (vCenter Server)	4.x	Any	CVE-2021-22048	7.1	important	Patch pending	KB86292	None
Cloud Foundation (vCenter Server)	3.x	Any	CVE-2021-22048	7.1	important	Patch Pending	KB86292	None

4. References

Fixed Version(s) and Release Notes:

KB86292
https://kb.vmware.com/s/article/86292
https://kb.vmware.com/s/article/89027

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22048

FIRST CVSSv3 Calculator:
CVE-2021-22048: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

5. Change Log

2021-11-10 VMSA-2021-0025
Initial security advisory.

2021-11-15 VMSA-2021-0025.1
Added vCenter Server 6.5 in the Response Matrix.

2022-07-12 VMSA-2021-0025.2
Added fixed version of vCenter Server 7.0 in the Response Matrix.

2022-07-23 VMSA-2021-0025.3
VMware has determined that vCenter 7.0u3f updates previously mentioned in the response matrix do not remediate CVE-2021-22048 and introduce a functional issue. Please review KB89027 for more information.

2022-10-11 VMSA-2021-0025.4
Added vCenter Server 8.0 in the Response Matrix.