VMware released a security patch for a remote code execution vulnerability that affects the VMware View Planner product.

VMware released a security patch for a remote code execution flaw, tracked as CVE-2021-21978, that affects the VMware View Planner.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.

The View Planner is a free tool for Performance Sizing and Benchmarking of Virtual Desktop Infrastructure environments.

The vulnerability was reported Positive Technologies researcher Mikhail Klyuchnikov.

The company fixed the CVE-2021-21978 vulnerability with the release of version 4.6 Security Patch 1 on March 2. The vulnerability received a CVSS score of 8.6.

“A vulnerability in VMware View Planner was privately reported to VMware. An update is available to remediate this vulnerability in affected VMware products.” reads te advisory published by the company. “Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.”

The issue is caused by the improper input validation and the lack of authorization that could allow an attacker to upload specially crafted files in logupload web application. The vulnerability could be exploited only by an attacker with network access.

VMware recommends installing the security patch, but it not known if the flaw has been exploited in attacks in the wild.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, VMware)

The post VMware addresses Remote Code Execution issue in View Planner appeared first on Security Affairs.

By admin