Thousands of publicly accessible VMware vCenter Servers vulnerable to critical flaws

This article has been indexed from CSO Online

Three weeks after releasing patches for a critical vulnerability in VMware vCenter, thousands of servers that are reachable from the internet remain vulnerable to attacks. VMware vCenter is used by enterprises to manage virtual machines, the VMware vSphere cloud virtualization solution, ESXi hypervisors, and other virtualized infrastructure components.

Remote code execution and authentication bypass

On May 25, VMware published a critical advisory and released patches covering two serious vulnerabilities that stem from the use of VMware vCenter plug-ins. The first vulnerability, tracked as CVE-2021-21985, is caused by improper input validation in the Virtual SAN (vSAN) Health Check plug-in that’s enabled by default in vCenter Server.

To read this article in full, please click here

Read the original article: Thousands of publicly accessible VMware vCenter Servers vulnerable to critical flaws