ZDI-CAN-17964: ZDI-23-116: VMware vRealize Log Insight getConfig Missing Authentication for Critical Function Information Disclosure Vulnerability
Published Feb 9, 2023
·Updated
This vulnerability allows remote attackers to disclose information on affected installations of VMware vRealize Log Insight. Authentication is not required to exploit this vulnerability.
Affected Software
1 affected component
VMware vRealize Log Insight
Event History
Feb 9, 2023
Advisory Published
06:00 AM
Data Sourced
06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-17964?
The severity of ZDI-CAN-17964 is considered high due to its potential to allow remote attackers to disclose sensitive information.
2
How do I fix ZDI-CAN-17964?
To fix ZDI-CAN-17964, upgrade to the latest version of VMware vRealize Log Insight as provided by VMware.
3
What types of information can be disclosed by exploiting ZDI-CAN-17964?
Exploiting ZDI-CAN-17964 can allow attackers to access sensitive configuration and log information from affected installations.
4
Is authentication required to exploit ZDI-CAN-17964?
No, authentication is not required to exploit ZDI-CAN-17964, making it particularly dangerous.
5
Which versions of VMware vRealize Log Insight are affected by ZDI-CAN-17964?
All versions of VMware vRealize Log Insight are affected by ZDI-CAN-17964.