There has finally been a patch released by VMware for an affected version of vCenter Server’s IWA mechanism, eight months after a high-severity privilege escalation vulnerability was disclosed.
CrowdStrike Security’s Yaron Zinar and Sagi Sheinfeld reported the vulnerability and it has been tracked as CVE-2021-22048 on their respective systems.
It also affects the hybrid cloud platform VMware’s Cloud Foundation as well, along with the IWA mechanism built into the vCenter Server.
An attacker can elevate privileges to a higher privileged group by successfully exploiting this vulnerability on unpatched vCenter Server deployments that do not require administrative access in order to execute malicious code.
Here below we have mentioned all the products that are impacted by this security flaw:-
This bug has been rated critical by VMware, which means it is in the range of severity for a critical bug. It means that the data of a user is compromised in a completely unreliable way due to authorized attacks or user assistance, which leads to a complete compromise of data integrity or confidentiality.
Since there are multiple versions of vCenter Server that are affected by this vulnerability, that’s why VMware has released update 3f for vCenter Server 7.0.
Since VMware’s security advisory was first published on November 10th, 2021, eight months ago, the company has provided a workaround to remove the attack vector.
VMware’s knowledgebase article claims that if an attack is attempted on Integrated Windows Authentication (IWA), administrators are advised to switch to Active Directory over LDAPs authentication or Identity Provider Federation for AD FS (vSphere 7.0 only) in order to prevent such attacks.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…