CVE-2021-22035: Medium severity vmware vcenter server and cloud foundation vulnerability

Q: What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2021-22035.

Q: What is the severity of CVE-2021-22035?

The severity of CVE-2021-22035 is medium, with a severity value of 4.3.

Q: What software is affected by CVE-2021-22035?

VMware vRealize Log Insight (8.x prior to 8.6) is affected by CVE-2021-22035.

Q: How can I fix CVE-2021-22035?

Apply the necessary security patch or upgrade to a version that is not affected by the vulnerability.

Published Oct 13, 2021

Updated

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.

Affected Software

3 affected components

VMware Cloud Foundation>=4.0.0<=4.3.1

VMware vRealize Log Insight>8.0.0<8.60

VMware Vrealize Suite Lifecycle Manager>=8.0.0<=8.2

Remediation

Patch Available

https://www.vmware.com/security/advisories/VMSA-2021-0022.html

Event History

Oct 13, 2021

CVE Published

via MITRE·03:50 PM

Data Sourced

via MITRE·03:50 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2021-22035.

What is the severity of CVE-2021-22035?

The severity of CVE-2021-22035 is medium, with a severity value of 4.3.

What software is affected by CVE-2021-22035?

VMware vRealize Log Insight (8.x prior to 8.6) is affected by CVE-2021-22035.

What is the impact of CVE-2021-22035?

An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight.

How can I fix CVE-2021-22035?