CVE-2021-21975

VMware Server Side Request Forgery in vRealize Operations Manager API

Published Mar 31, 2021 · updated Oct 2, 2026 · vmware cloud foundation

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Timeline

Detection, updates, and resolution for this record.

Mar 31, 2021 · Catalog
Detected
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
Jan 18, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Feb 1, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Oct 2, 2026 · Catalog
Updated
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Required action

Apply updates per vendor instructions.

CISA due date Feb 1, 2022

Affected

cpe vmware/cloud foundation3.0
cpe vmware/cloud foundation3.0.1
cpe vmware/cloud foundation3.0.1.1
cpe vmware/cloud foundation3.5
cpe vmware/cloud foundation3.5.1
cpe vmware/cloud foundation3.7
cpe vmware/cloud foundation3.7.1
cpe vmware/cloud foundation3.7.2
vendor VMware vRealize Operations Manager APIversion unspecified

Sources

CISA KEVCVE-2021-21975
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
cisa.gov
CVE.orgCVE-2021-21975
Official CVE identifier
cve.org
FIRST EPSSCVE-2021-21975
30-day exploitation probability 78.0%
first.org
Metasploit Modulesexploit_linux/http/vmware_vrops_mgr_ssrf_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2021-21975
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
nvd.nist.gov
Packet Storm Security/packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com