PT-2021-7283 · Vmware · Vmware Vrealize Orchestrator

Marek Takáč · Published 2021-10-12 · Updated 2021-10-20 · CVE-2021-22036

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware vRealize Orchestrator versions 8.x prior to 8.6

Description The issue is related to improper path handling, which may allow a malicious actor to redirect victims to an attacker-controlled domain, potentially leading to sensitive information disclosure. This is due to an open redirect vulnerability in the platform.

Recommendations For versions 8.x prior to 8.6, update to version 8.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and monitoring for suspicious redirects.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-05137

CVE-2021-22036

Affected Products

Vmware Vrealize Orchestrator

References · 5

• https://vmware.com/security/advisories/VMSA-2021-0023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22036 · Security Note
• https://bdu.fstec.ru/vul/2022-05137 · Security Note
• https://t.me/cibsecurity/30513 · Telegram Post