vulnerability

VMWare vRealize: (CVE-2021-22025)

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
5	(AV:N/AC:L/Au:N/C:N/I:P/A:N)	Aug 24, 2021	Nov 4, 2021	Jan 12, 2023

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:N)

Published

Aug 24, 2021

Added

Nov 4, 2021

Modified

Jan 12, 2023

Description

The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.

Solutions

vmware-vrealize-upgrade-7_5_0_18528913vmware-vrealize-upgrade-8_0_1_18442173vmware-vrealize-upgrade-8_1_1_18442224vmware-vrealize-upgrade-8_2_0_18439239vmware-vrealize-upgrade-8_3_0_18439213vmware-vrealize-upgrade-8_4_0_18456797vmware-vrealize-upgrade-8_5_0

References

CVE-2021-22025
https://attackerkb.com/topics/CVE-2021-22025
URL-https://www.vmware.com/security/advisories/VMSA-2021-0018.html

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today