CVE-2021-22023
published 2021-08-30CVE-2021-22023: The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize…
PriorityP339high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.00%
58.8th percentile
The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | cloud_foundation | 3.0 – 3.10.2.1 | — |
| vmware | cloud_foundation | 4.0 – 4.2.1 | — |
| vmware | vrealize_operations_manager | — | — |
| vmware | vrealize_operations_manager | >= 8.0.0 < 8.5.0 | 8.5.0 |
| vmware | vrealize_suite_lifecycle_manager | 8.0 – 8.2 | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qh32-g7xq-vjj8: The vRealize Operations Manager API (8
ghsa_unreviewed·2022-05-24
CVE-2021-22023 [HIGH] CWE-639 GHSA-qh32-g7xq-vjj8: The vRealize Operations Manager API (8
The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover.
VMware
VMware vRealize Operations updates address multiple security vulnerabilities (CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027)
vendor_vmware·2021-08-24·CVSS 4.9
CVE-2021-22022 [MEDIUM] VMware vRealize Operations updates address multiple security vulnerabilities (CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027)
VMSA-2021-0018: VMware vRealize Operations updates address multiple security vulnerabilities (CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027)
The vRealize Operations Manager API contains an arbitrary file read vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.
CVEs: CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027
Affected products: VMware Aria, VMware Cloud Foundation, VMware vRealize
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-08-30
Published