{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2021-21973",
  "revision": 1,
  "title": "VMware vCenter — Request Forgery in the vSphere Client",
  "summary": "A vCenter plugin does not check the addresses it is asked to fetch, so anyone who can reach the management port makes the server issue requests on their behalf and map the network behind it.",
  "source_type": "cve",
  "severity": "medium",
  "cvss": {
    "score": 5.3,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "version": "3.1"
  },
  "epss": 0.88012,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2022-03-07",
    "prerequisites": "Network access to the vCenter management port"
  },
  "remediation": {
    "patch_available": true
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "discovery",
  "recommended_action": "Apply VMware's patch for vCenter Server, and restrict who can reach the management port.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "references",
        "published_at"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21973",
      "retrieved_at": "2026-08-07T16:15:34.205Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-08-07T16:15:34.205Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2021-21973",
      "retrieved_at": "2026-08-07T16:15:34.205Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2021-21973",
      "retrieved_at": "2026-08-07T16:15:34.205Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21973",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0002.html"
    }
  ],
  "published_at": "2021-02-24T17:15:15.923Z",
  "issued_at": "2026-08-07T16:15:34.205Z",
  "tags": [
    "vmware",
    "vcenter",
    "request-forgery"
  ]
}