For system Admins and Engineers, Vcenter is a critical tool for managing and deploying our infrastructure, hence patching and updating to avoid opening loopholes and security breaches is very important. VMware released its latest advisory. It includes 19 new vulnerabilities on versions 6.5, 6.7, and 7.0 and the most critical is the vCenter file upload vulnerability rated with a high base score of 9.8. Any attacker with access to the network port 443 on a vCenter server is able to exploit this vulnerability and execute a code that uploaded infected files.
CVE-2021-22005 is a file upload vulnerability in the vCenter Server. An unauthenticated attacker capable of accessing port 443 over the same network or directly from the internet could exploit a vulnerable vCenter Server by uploading a file to the vCenter Server analytics service
Resolution
The recommended fix is to upgrade/patch to the latest version released on the 21st of September 2021. Here is a reference link: Vmware
I hope you found this blog post helpful. If you have any questions, please let me know in the comment session.