

{"id":4199,"date":"2023-06-08T16:54:08","date_gmt":"2023-06-08T13:54:08","guid":{"rendered":"https:\/\/csirt.lacnic.net\/?p=4199"},"modified":"2023-06-08T20:48:24","modified_gmt":"2023-06-08T17:48:24","slug":"vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974","status":"publish","type":"post","link":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974","title":{"rendered":"Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)"},"content":{"rendered":"\n<p>Em primeiro lugar, a vulnerabilidade identificada como <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-21972\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2021-21972<\/a> e classificada como cr\u00edtica permite a execu\u00e7\u00e3o remota de comandos no sistema operacional em que o cliente vSphere (HTML5) possa ser acessado pela rede. Esta vulnerabilidade \u00e9 encontrada em um plugin do cliente vSphere (HTML5) que est\u00e1 instalado por padr\u00e3o no servidor.<\/p>\n\n\n\n<p>Para explorar esta vulnerabilidade, o atacante precisa executar comandos por meio da URL vulner\u00e1vel do servidor afetado.<\/p>\n\n\n\n<p>As vers\u00f5es afetadas e suas corre\u00e7\u00f5es s\u00e3o:<\/p>\n\n\n\n<figure class=\"wp-block-table tabla\"><table><tbody><tr><td>Produto<\/td><td>Vers\u00e3o<\/td><td>CVSSv3<\/td><td>Severidade<\/td><td>Vers\u00e3o corrigida<\/td><\/tr><tr><td>vCenter Server<\/td><td>7.0<\/td><td><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">9.8<\/a><\/td><td>Cr\u00edtica<\/td><td><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/7.0\/rn\/vsphere-vcenter-server-70u1c-release-notes.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">7.0 U1c<\/a><\/td><\/tr><tr><td>vCenter Server<\/td><td>6.7<\/td><td><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener\">9<\/a><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">.<\/a><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener\">8<\/a><\/td><td>Cr\u00edtica<\/td><td><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.7\/rn\/vsphere-vcenter-server-67u3l-release-notes.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">6.7 U3l<\/a><\/td><\/tr><tr><td>vCenter Server<\/td><td>6.5<\/td><td><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">9.8<\/a><\/td><td>Cr\u00edtica<\/td><td><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.5\/rn\/vsphere-vcenter-server-65u3n-release-notes.html\" rel=\"nofollow\">6.5 U3n<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>A seguinte vulnerabilidade classificada como importante \u00e9 identificada como <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-21974\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2021-21974<\/a>. Um atacante que tenha acesso \u00e0 porta 427 TCP\/UDP do hipervisor ESXi pode executar c\u00f3digo de forma remota executando um ataque heap-overflow no servi\u00e7o OpenSLP.<\/p>\n\n\n\n<p>As vers\u00f5es afetadas e suas corre\u00e7\u00f5es s\u00e3o:<\/p>\n\n\n\n<figure class=\"wp-block-table tabla\"><table><tbody><tr><td>Produto<\/td><td>Vers\u00e3o<\/td><td>CVE Identifier<\/td><td>CVSSv3<\/td><td>Vers\u00e3o corrigida<\/td><\/tr><tr><td>ESXi<\/td><td>7.0<\/td><td>CVE-2021-21974<\/td><td><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:A\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">8.8<\/a><\/td><td>ESXi70U1c-17325551<\/td><\/tr><tr><td>ESXi<\/td><td>6.7<\/td><td>CVE-2021-21974<\/td><td><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:A\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\">8.8<\/a><\/td><td>ESXi670-202102401-SG<\/td><\/tr><tr><td>&nbsp;ESXi<\/td><td>6.5<\/td><td>CVE-2021-21974<\/td><td><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1%23CVSS:3.1\/AV:A\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">8.8<\/a><\/td><td>ESXi650-202102101-SG<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>A terceira vulnerabilidade identificada como <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-21973\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2021-21973<\/a> com um n\u00edvel de criticidade moderada se encontra em um plugin do cliente HTML5 de vSphere. De acordo com VMware, \u00e9 poss\u00edvel realizar um ataque SSRF (Server Side Request Forgery) por meio de um URL mal validado do lado do servidor vCenter.<\/p>\n\n\n\n<p>Uma pessoa mal-intencionada precisa acesso \u00e0 porta 443 para enviar uma solicita\u00e7\u00e3o POST ao URL vulner\u00e1vel e assim explorar a vulnerabilidade.<\/p>\n\n\n\n<p>Tanto a vulnerabilidade CVE-2021-21972 quanto a vulnerabilidade CVE-2021-21973 \u00e9 poss\u00edvel corrigi-las atualizando o sistema ou seguindo os passos do guia <a href=\"https:\/\/kb.vmware.com\/s\/article\/82374\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">KB82374<\/a><strong>.<\/strong><\/p>\n\n\n\n<p>No Github podem ser encontradas provas de conceito para ambas as vulnerabilidades, isso agrava o problema, pois a vulnerabilidade poderia ser explorada sem ter conhecimentos da tecnologia VMware.<\/p>\n\n\n\n<figure class=\"wp-block-table tabla\"><table><tbody><tr><td>Produto<\/td><td>Vers\u00e3o<\/td><td>Vers\u00e3o corrigida<\/td><td>Workarounds<\/td><\/tr><tr><td>vCenter Server<\/td><td>7.0<\/td><td><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/7.0\/rn\/vsphere-vcenter-server-70u1c-release-notes.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">7.0 U1c<\/a><\/td><td><a href=\"https:\/\/kb.vmware.com\/s\/article\/82374\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">KB82374<\/a><\/td><\/tr><tr><td>vCenter Server<\/td><td>6.7<\/td><td><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.7\/rn\/vsphere-vcenter-server-67u3l-release-notes.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">6.7 U3l<\/a><\/td><td><a href=\"https:\/\/kb.vmware.com\/s\/article\/82374\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">KB82374<\/a><\/td><\/tr><tr><td>vCenter Server<\/td><td>6.5<\/td><td><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.5\/rn\/vsphere-vcenter-server-65u3n-release-notes.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">6.5 U3n<\/a><\/td><td><a href=\"https:\/\/kb.vmware.com\/s\/article\/82374\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">KB82374<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Recomenda\u00e7\u00e3o<\/strong><strong><\/strong><\/h2>\n\n\n\n<p>Desde o LACNIC CSIRT recomendamos instalar as \u00faltimas vers\u00f5es dos sistemas e evitar expor servi\u00e7os para a Internet.<\/p>\n\n\n\n<p>Do outro lado, \u00e9 aconselh\u00e1vel analisar os logs do servidor web em busca de uma poss\u00edvel explora\u00e7\u00e3o desta vulnerabilidade, que com base nos exploit p\u00fablicos, dever-se-ia pesquisar no URI abaixo:<\/p>\n\n\n\n<p><strong>\u201c\/ui\/vropspluginui\/rest\/services\/uploadova\u201d<\/strong><strong><\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Mais informa\u00e7\u00f5es<\/strong><strong><\/strong><\/h3>\n\n\n\n<p><a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0002.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0002.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Em primeiro lugar, a vulnerabilidade identificada como CVE-2021-21972 e classificada como cr\u00edtica permite a execu\u00e7\u00e3o remota de comandos no sistema operacional em que o cliente vSphere (HTML5) possa ser acessado pela rede. Esta vulnerabilidade \u00e9 encontrada em um plugin do cliente vSphere (HTML5) que est\u00e1 instalado por padr\u00e3o no servidor. Para explorar esta vulnerabilidade, o [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[54,55],"tags":[],"class_list":["post-4199","post","type-post","status-publish","format-standard","hentry","category-alertas-de-seguranca","category-arquivo-pt-br"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LACNIC CSIRT - Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LACNIC CSIRT - Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)\" \/>\n<meta property=\"og:description\" content=\"Em primeiro lugar, a vulnerabilidade identificada como CVE-2021-21972 e classificada como cr\u00edtica permite a execu\u00e7\u00e3o remota de comandos no sistema operacional em que o cliente vSphere (HTML5) possa ser acessado pela rede. Esta vulnerabilidade \u00e9 encontrada em um plugin do cliente vSphere (HTML5) que est\u00e1 instalado por padr\u00e3o no servidor. Para explorar esta vulnerabilidade, o [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\" \/>\n<meta property=\"og:site_name\" content=\"LACNIC CSIRT\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-08T13:54:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-08T17:48:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/csirt.lacnic.net\/wp-content\/uploads\/lacnic-csirt-2020.png\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" \/>\n\t<meta property=\"og:image:height\" content=\"330\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Gianni Arena\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@lacnic_csirt\" \/>\n<meta name=\"twitter:site\" content=\"@lacnic_csirt\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\"},\"author\":{\"name\":\"Gianni Arena\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#\\\/schema\\\/person\\\/d5c65fde1dbe338128788dcc20e9f5d3\"},\"headline\":\"Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)\",\"datePublished\":\"2023-06-08T13:54:08+00:00\",\"dateModified\":\"2023-06-08T17:48:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\"},\"wordCount\":413,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#organization\"},\"articleSection\":[\"Alertas de seguran\u00e7a\",\"Arquivo\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\",\"url\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\",\"name\":\"LACNIC CSIRT - Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#website\"},\"datePublished\":\"2023-06-08T13:54:08+00:00\",\"dateModified\":\"2023-06-08T17:48:24+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/alertas-de-seguranca\\\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/\",\"name\":\"LACNIC CSIRT\",\"description\":\"Centro de Respuestas de Incidentes - LACNIC CSIRT\",\"publisher\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#organization\",\"name\":\"LACNIC CSIRT\",\"url\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/csirt.lacnic.net\\\/wp-content\\\/uploads\\\/lacnic-csirt-2020.png\",\"contentUrl\":\"https:\\\/\\\/csirt.lacnic.net\\\/wp-content\\\/uploads\\\/lacnic-csirt-2020.png\",\"width\":680,\"height\":330,\"caption\":\"LACNIC CSIRT\"},\"image\":{\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/lacnic_csirt\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/csirt.lacnic.net\\\/en\\\/#\\\/schema\\\/person\\\/d5c65fde1dbe338128788dcc20e9f5d3\",\"name\":\"Gianni Arena\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cc620878b92e4930abb5951af723f7e852088c31f8489beda9016e53725fb1f2?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cc620878b92e4930abb5951af723f7e852088c31f8489beda9016e53725fb1f2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cc620878b92e4930abb5951af723f7e852088c31f8489beda9016e53725fb1f2?s=96&d=mm&r=g\",\"caption\":\"Gianni Arena\"},\"url\":\"https:\\\/\\\/csirt.lacnic.net\\\/pt-br\\\/author\\\/gianni\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LACNIC CSIRT - Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974","og_locale":"pt_BR","og_type":"article","og_title":"LACNIC CSIRT - Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)","og_description":"Em primeiro lugar, a vulnerabilidade identificada como CVE-2021-21972 e classificada como cr\u00edtica permite a execu\u00e7\u00e3o remota de comandos no sistema operacional em que o cliente vSphere (HTML5) possa ser acessado pela rede. Esta vulnerabilidade \u00e9 encontrada em um plugin do cliente vSphere (HTML5) que est\u00e1 instalado por padr\u00e3o no servidor. Para explorar esta vulnerabilidade, o [&hellip;]","og_url":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974","og_site_name":"LACNIC CSIRT","article_published_time":"2023-06-08T13:54:08+00:00","article_modified_time":"2023-06-08T17:48:24+00:00","og_image":[{"width":680,"height":330,"url":"https:\/\/csirt.lacnic.net\/wp-content\/uploads\/lacnic-csirt-2020.png","type":"image\/png"}],"author":"Gianni Arena","twitter_card":"summary_large_image","twitter_creator":"@lacnic_csirt","twitter_site":"@lacnic_csirt","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#article","isPartOf":{"@id":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974"},"author":{"name":"Gianni Arena","@id":"https:\/\/csirt.lacnic.net\/en\/#\/schema\/person\/d5c65fde1dbe338128788dcc20e9f5d3"},"headline":"Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)","datePublished":"2023-06-08T13:54:08+00:00","dateModified":"2023-06-08T17:48:24+00:00","mainEntityOfPage":{"@id":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974"},"wordCount":413,"commentCount":0,"publisher":{"@id":"https:\/\/csirt.lacnic.net\/en\/#organization"},"articleSection":["Alertas de seguran\u00e7a","Arquivo"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#respond"]}]},{"@type":"WebPage","@id":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974","url":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974","name":"LACNIC CSIRT - Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)","isPartOf":{"@id":"https:\/\/csirt.lacnic.net\/en\/#website"},"datePublished":"2023-06-08T13:54:08+00:00","dateModified":"2023-06-08T17:48:24+00:00","breadcrumb":{"@id":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/csirt.lacnic.net\/pt-br\/alertas-de-seguranca\/vulnerabilidades-criticas-no-vmware-esxi-e-no-vcenter-server-cve-2021-21972-cve-2021-21973-cve-2021-21974#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/csirt.lacnic.net\/pt-br"},{"@type":"ListItem","position":2,"name":"Vulnerabilidades cr\u00edticas no VMware ESXi e no vCenter Server (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)"}]},{"@type":"WebSite","@id":"https:\/\/csirt.lacnic.net\/en\/#website","url":"https:\/\/csirt.lacnic.net\/en\/","name":"LACNIC CSIRT","description":"Centro de Respuestas de Incidentes - LACNIC CSIRT","publisher":{"@id":"https:\/\/csirt.lacnic.net\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/csirt.lacnic.net\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/csirt.lacnic.net\/en\/#organization","name":"LACNIC CSIRT","url":"https:\/\/csirt.lacnic.net\/en\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/csirt.lacnic.net\/en\/#\/schema\/logo\/image\/","url":"https:\/\/csirt.lacnic.net\/wp-content\/uploads\/lacnic-csirt-2020.png","contentUrl":"https:\/\/csirt.lacnic.net\/wp-content\/uploads\/lacnic-csirt-2020.png","width":680,"height":330,"caption":"LACNIC CSIRT"},"image":{"@id":"https:\/\/csirt.lacnic.net\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/lacnic_csirt"]},{"@type":"Person","@id":"https:\/\/csirt.lacnic.net\/en\/#\/schema\/person\/d5c65fde1dbe338128788dcc20e9f5d3","name":"Gianni Arena","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/cc620878b92e4930abb5951af723f7e852088c31f8489beda9016e53725fb1f2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/cc620878b92e4930abb5951af723f7e852088c31f8489beda9016e53725fb1f2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cc620878b92e4930abb5951af723f7e852088c31f8489beda9016e53725fb1f2?s=96&d=mm&r=g","caption":"Gianni Arena"},"url":"https:\/\/csirt.lacnic.net\/pt-br\/author\/gianni"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/posts\/4199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/comments?post=4199"}],"version-history":[{"count":0,"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/posts\/4199\/revisions"}],"wp:attachment":[{"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/media?parent=4199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/categories?post=4199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/csirt.lacnic.net\/pt-br\/wp-json\/wp\/v2\/tags?post=4199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}