Vulnerability Description
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Cloud Foundation | >= 3.0, <= 3.10.2.1 |
| Vmware | Vrealize Operations Manager | >= 8.0.0, < 8.5.0 |
| Vmware | Vrealize Suite Lifecycle Manager | >= 8.0, <= 8.2 |
Related Weaknesses (CWE)
References
- https://www.vmware.com/security/advisories/VMSA-2021-0018.htmlPatchVendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2021-0018.htmlPatchVendor Advisory
FAQ
What is CVE-2021-22024?
CVE-2021-22024 is a vulnerability with a CVSS score of 7.5 (HIGH). The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API ...
How severe is CVE-2021-22024?
CVE-2021-22024 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-22024?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Cloud Foundation, Vmware Vrealize Operations Manager, Vmware Vrealize Suite Lifecycle Manager.