CVE-2021-22025

published 2021-08-30

CVE-2021-22025: The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I H A N

The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
vmware	cloud_foundation	3.0 – 3.10.2.1	—
vmware	cloud_foundation	4.0 – 4.2.1	—
vmware	vrealize_operations_manager	—	—
vmware	vrealize_operations_manager	>= 8.0.0 < 8.5.0	8.5.0
vmware	vrealize_suite_lifecycle_manager	8.0 – 8.2	—

CWE-287