---
id: 5124
title: "Unauthorized RCE in VMware vCenter"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/unauth-rce-vmware/"
published_at: "2021-02-24T17:11:03Z"
tags: ["rce", "vulnerability-research", "vmware", "cve", "ssrf"]
phying_url: "https://phying.com/item/5124"
lang: en
---

# Unauthorized RCE in VMware vCenter

## Summary

Technical details of the VMware vSphere Client flaws found in fall 2020: an unauthorized file upload in the vropspluginui plugin leading to RCE (CVE-2021-21972) and an unauthenticated SSRF (CVE-2021-21973), both exploitable without credentials.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2021-02-24T17:11:03Z
- **Original:** https://swarm.ptsecurity.com/unauth-rce-vmware/
- **Phying News:** https://phying.com/item/5124