ZDI-23-116: VMware vRealize Log Insight getConfig Missing Authentication for Critical Function Information Disclosure Vulnerability
Published Feb 9, 2023
·Updated
This vulnerability allows remote attackers to disclose information on affected installations of VMware vRealize Log Insight. Authentication is not required to exploit this vulnerability.
Affected Software
1 affected component
VMware vRealize Log Insight
Event History
Feb 9, 2023
Advisory Published
06:00 AM
Data Sourced
06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-23-116?
The severity of ZDI-23-116 is classified as critical due to the potential for unauthorized information disclosure.
2
How do I fix ZDI-23-116?
To fix ZDI-23-116, VMware recommends installing the latest security updates for vRealize Log Insight.
3
What type of attacks are possible with ZDI-23-116?
ZDI-23-116 allows remote attackers to disclose sensitive information from affected installations without requiring authentication.
4
Which versions of VMware vRealize Log Insight are affected by ZDI-23-116?
ZDI-23-116 affects all versions of VMware vRealize Log Insight that are not updated to the latest patch.
5
Is authentication required to exploit ZDI-23-116?
No, authentication is not required to exploit ZDI-23-116, making it particularly dangerous.