✕
Request a Demo
Rewterz
Rewterz Threat Alert – Lazarus APT Group – Active IOCs
October 12, 2021
Rewterz
Rewterz Threat Advisory – ICS: Schneider Electric IGSS
October 13, 2021

Rewterz Threat Advisory – Multiple VMware vRealize Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2021-22033

A malicious actor with administrative access to vRealize Operations can enumerate internal IPs and internal ports.

CVE-2021-22035

An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in the user’s environment.

CVE-2021-22036

A malicious actor may be able to redirect victim to an attacker-controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.

Impact

  • Arbitrary Code Execution
  • Exposure of Sensitive Data
  • Unauthorized Access

Affected Vendors

  • VMware

Affected Products

  • VMware vRealize Operations
  • VMware Cloud Foundation
  • vRealize Suite Lifecycle Manager
  • VMware vRealize Log Insight

Remediation

Refer to VMware Security Advisory for patch, upgrade, or suggested workaround information.

CVE-2021-22033

https://www.vmware.com/security/advisories/VMSA-2021-0021.html

CVE-2021-22035

https://www.vmware.com/security/advisories/VMSA-2021-0022.html

CVE-2021-22036

https://www.vmware.com/security/advisories/VMSA-2021-0023.html