CVE-2022-31710

CWE-502 — Deserialization of Untrusted Data4 documents4 sources
Severity
7.5HIGH
EPSS
0.8%
top 26.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Vmware Vrealize LOG Insight
Timeline
PublishedJan 26

Description

vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDvmware/vrealize_log_insight8.0.0 — 8.10.2+1
▶CVEListV5vrealize_log_insight_(vrli)vRealize Log Insight 8.10.1 and prior

Patches

Patch: www.vmware.com ↗Patch: www.vmware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-f25w-7vp8-h4hw: vRealize Log Insight contains a deserialization vulnerability↗2023-01-26
▶
CVEList
CVE-2022-31710: vRealize Log Insight contains a deserialization vulnerability↗2023-01-25
▶

📋Vendor Advisories

1
VMware
VMware vRealize Log Insight latest updates address multiple security vulnerabilities (CVE-2022-31706, CVE-2022-31704, CVE-2022-31710, CVE-2022-31711)↗2023-01-24
▶
CVE-2022-31710 (HIGH CVSS 7.5) | vRealize Log Insight contains a des | cvebase.io