BlackTreeCVE IntelligenceVMware · vCenter Server
CISA confirms exploitation in the wild and lists 2021-11-17 as the remediation due date.
CISA confirms exploitation in the wild and lists 2021-11-17 as the remediation due date.
Patch availableVMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2021-11-03. Known ransomware campaign use is recorded.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 23 Sept 2021 · Last source change 21 Oct 2025, 23:25 UTC · CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Core structured fields are present and their contributing authorities are shown above.