Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-21973

CVE-2021-21973MEDIUM

n/a VMware vCenter Server — VMware vCenter Server and Cloud Foundation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .8764   99.8   YES

AFFECTED
  Product                  Versions              Fixed
  VMware vCenter Server    7.x before 7.0 U1c –  —
  VMware Cloud Foundation  4.x before 4.2 –      —

TIMELINE
  Jan 4   Reserved by vmware
  Feb 24  Published (CNA: vmware)
  Mar 7   Added to CISA KEV, remediation due 2022-03-21

CWE-918 · CNA: vmware · CVSS v3.1 · 2 references · KEV due March 21, 2022

Description

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 4, 2021	Reserved	Reserved by vmware
February 24, 2021	Published	Published (CNA: vmware)
March 7, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-03-21

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	VMware vCenter Server	—	7.x before 7.0 U1c	—
n/a	VMware Cloud Foundation	—	4.x before 4.2	—

Weaknesses

CWE-918

References (2)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973 [government-resource]
https://www.vmware.com/security/advisories/VMSA-2021-0002.html [x_refsource_CONFIRM]

Authoritative record: CVE-2021-21973 at cve.org

Weaknesses: CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-21973 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.