PT-2021-4209 · Vmware · Vrealize Operations Manager Api

Egor Dimitrenko · Published 2021-08-24 · Updated 2022-02-01 · CVE-2021-22023

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5

Description The issue is related to an insecure object reference vulnerability in the vRealize Operations Manager API. This vulnerability can be exploited by a malicious actor with administrative access, potentially allowing them to modify other users' information and leading to an account takeover. The vulnerability is also associated with insufficient validation of incoming requests, which could allow a remote attacker to disclose protected information.

Recommendations For versions 8.x prior to 8.5, update to version 8.5 or later to resolve the issue. As a temporary workaround, consider restricting administrative access to the vRealize Operations Manager API to minimize the risk of exploitation. Additionally, monitor user account activity for any suspicious modifications.

Fix

IDOR

SSRF

Weakness Enumeration

CWE-639

CWE-918

Related Identifiers

BDU:2021-04810

CVE-2021-22023

Affected Products

Vrealize Operations Manager Api

References · 6

• https://osv.dev/vulnerability/CVE-2021-22023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22023 · Security Note
• https://bdu.fstec.ru/vul/2021-04810 · Security Note
• https://vmware.com/security/advisories/VMSA-2021-0018.html · Vendor Advisory
• https://t.me/cvenotify/20601 · Telegram Post
• https://t.me/ckure/9042 · Telegram Post