CVE-2021-22035
First published: Wed Oct 13 2021(Updated: )
VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Cloud Foundation | >=4.0.0<=4.3.1 | |
| VMware vRealize Log Insight | >8.0.0<8.60 | |
| Vmware Vrealize Suite Lifecycle Manager | >=8.0.0<=8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-22035.
What is the severity of CVE-2021-22035?
The severity of CVE-2021-22035 is medium, with a severity value of 4.3.
What software is affected by CVE-2021-22035?
VMware vRealize Log Insight (8.x prior to 8.6) is affected by CVE-2021-22035.
What is the impact of CVE-2021-22035?
An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight.
How can I fix CVE-2021-22035?
Apply the necessary security patch or upgrade to a version that is not affected by the vulnerability.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/softwarecombine
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/vmware
- canonical/vmware cloud foundation
- version/vmware cloud foundation/4.0.0
- version/vmware cloud foundation/4.3.1
- canonical/vmware vrealize log insight
- canonical/vmware vrealize suite lifecycle manager
- version/vmware vrealize suite lifecycle manager/8.0.0
- version/vmware vrealize suite lifecycle manager/8.2