PT-2020-2046 · Vmware · Vmware Vrealize Log Insight

Published 2020-04-15 · Updated 2021-07-21 · CVE-2020-3954

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VMware vRealize Log Insight versions prior to 8.1.0

Description The issue is related to insufficient input validation, which can be exploited by a remote attacker to redirect users to a malicious site. This is due to an Open Redirect vulnerability.

Recommendations For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue.

Fix

Open Redirect

RCE

Weakness Enumeration

CWE-601

CWE-20

Related Identifiers

BDU:2020-01733

CVE-2020-3954

Affected Products

Vmware Vrealize Log Insight

References · 5

• https://vmware.com/security/advisories/VMSA-2020-0007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3954 · Security Note
• https://bdu.fstec.ru/vul/2020-01733 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3954 · Vendor Advisory
• https://t.me/cvenotify/2812 · Telegram Post