CVE-2021-22014: 
vSphere vCenter Server vulnerability analysis and mitigation

CVE-2021-22014 is an authenticated code execution vulnerability discovered in VMware vCenter Server's VAMI (Virtual Appliance Management Infrastructure) component. The vulnerability was disclosed on September 21, 2021, and affects VMware vCenter Server versions 6.5, 6.7, and 7.0. VMware evaluated this vulnerability with a CVSSv3 base score of 7.2, categorizing it in the Important severity range (VMware Advisory).

The vulnerability exists in the VAMI (Virtual Appliance Management Infrastructure) component of vCenter Server. It requires network access to port 5480 on vCenter Server and authenticated VAMI user credentials for exploitation. The vulnerability has been assigned a CVSSv3 base score of 7.2 with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, high privileges required, no user interaction needed, and potential for high impact on confidentiality, integrity, and availability (NVD).

A successful exploitation of this vulnerability allows an authenticated VAMI user with network access to execute code on the underlying operating system that hosts vCenter Server. This could potentially lead to complete compromise of the affected system, impacting the confidentiality, integrity, and availability of the vCenter Server (VMware Advisory).

VMware has released patches to address this vulnerability in the following versions: vCenter Server 7.0 U2c, 6.7 U3o, and 6.5 U3q. No workarounds are available for this vulnerability, so applying the appropriate patch is the only recommended mitigation (VMware Advisory).