CVE-2021-22035

CWE-744 documents4 sources
Severity
4.3MEDIUM
EPSS
0.3%
top 49.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Vmware Vrealize LOG InsightVmware Cloud FoundationVmware Vrealize Suite Lifecycle Manager
Timeline
PublishedOct 13
Latest updateMay 24

Description

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5vmware_vrealize_log_insightVMware vRealize Log Insight (8.x prior to 8.6)
▶NVDvmware/cloud_foundation4.0.0 — 4.3.1

Patches

Patch: www.vmware.com ↗Patch: www.vmware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p728-xw8r-5f6m: VMware vRealize Log Insight (8↗2022-05-24
▶
CVEList
CVE-2021-22035: VMware vRealize Log Insight (8↗2021-10-13
▶

📋Vendor Advisories

1
VMware
VMware vRealize Log Insight updates address CSV injection vulnerability (CVE-2021-22035)↗2021-10-12
▶
CVE-2021-22035 (MEDIUM CVSS 4.3) | VMware vRealize Log Insight (8.x pr | cvebase.io