SB2021120331 - Multiple Vulnerabilities IBM Cloud Pak System 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021120331

SB2021120331 - Multiple Vulnerabilities IBM Cloud Pak System

Published: December 3, 2021 Updated: February 1, 2023

Security Bulletin ID SB2021120331
Severity
Critical
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 8% High 8% Medium 67% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2021-21985)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Virtual SAN Health Check plug-in, which is enabled by default. A remote non-authenticated attacker can send a specially crafted HTTP request to the vSphere Client available at port 443/tcp and execute arbitrary commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.


2) Improper Authentication (CVE-ID: CVE-2021-21986)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests to the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-21991)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way the vCenter Server handles session tokens. A local user can escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).


4) Input validation error (CVE-ID: CVE-2021-21992)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing XML data. A remote user can pass specially crafted XML data to the application and perform a denial of service (DoS) attack.


5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-21993)

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


6) Improper Authorization (CVE-ID: CVE-2021-22006)

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper URI handling in reverse proxy. A remote non-authenticate attacker can send a specially crafted HTTP request to port 443/TCP and access restricted endpoints.

7) Information disclosure (CVE-ID: CVE-2021-22008)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in VAPI (vCenter API) service. A remote attacker with access to port 443/TCP can gain unauthorized access to sensitive information on the system.


8) Resource exhaustion (CVE-ID: CVE-2021-22009)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the VAPI (vCenter API) service. A remote attacker can send specially crafted HTTP request to port 443/TCP and perform a denial of service (DoS) attack.


9) Resource exhaustion (CVE-ID: CVE-2021-22010)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the VPXD (Virtual Provisioning X Daemon) service. A remote attacker can send a secially crafted HTTP request to port 443/TCP and consume all available memory resources.


10) Improper Authentication (CVE-ID: CVE-2021-22011)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for an API endpoint in vCenter Server Content Library. A remote non-authenticated attacker with access to port 443/TCP can gain unauthorized access to the system and perform unauthenticated VM network setting manipulation.


11) Cross-site scripting (CVE-ID: CVE-2021-22016)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


12) Improper Authorization (CVE-ID: CVE-2021-22017)

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper implementation of URI normalization in rhttpproxy. A remote non-authenticate attacker can request a specially crafted URL, bypass rhttpproxy and access internal endpoints.


Remediation

Install update from vendor's website.

References