PT-2021-4134 · Vmware · Vrealize Operations Manager Api

Thiscodecc · Published 2021-08-24 · Updated 2022-02-01 · CVE-2021-22025

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager versions 8.x prior to 8.5

Description The issue is related to a broken access control vulnerability in the vRealize Operations Manager API, allowing unauthenticated API access. An unauthenticated malicious actor with network access to the API can add new nodes to an existing cluster. The vulnerability is also associated with insufficient validation of incoming requests, which can be exploited by a remote attacker to disclose protected information.

Recommendations For versions 8.x prior to 8.5, update to version 8.5 or later to resolve the issue. As a temporary workaround, consider restricting network access to the vRealize Operations Manager API to minimize the risk of exploitation.

Fix

Improper Authentication

SSRF

Weakness Enumeration

CWE-287

CWE-918

Related Identifiers

BDU:2021-04727

CVE-2021-22025

Affected Products

Vrealize Operations Manager Api

References · 5

• https://vmware.com/security/advisories/VMSA-2021-0018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22025 · Security Note
• https://bdu.fstec.ru/vul/2021-04727 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22025 · Vendor Advisory
• https://t.me/cvenotify/20602 · Telegram Post