UpHeron
All vulnerabilities

Servers and applications

CVE-2021-22017

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 10 Jan 2022.

Severity
Medium 5.3
Published
23 Sept 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
VMware vCenter ServerServers and applications · cpe:a:vmware:vcenter_server
  • Version 6.7

Known exploited

CISA name
VMware vCenter Server Improper Access Control
Required action
Apply updates per vendor instructions.
Due for US agencies
24 Jan 2022
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22017
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22017