7.2
CVE-2021-22023
- EPSS 0.32%
- Published 30.08.2021 18:15:08
- Last modified 21.11.2024 05:49:27
- Source security@vmware.com
- Teams watchlist Login
- Open Login
The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover.
Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Cloud Foundation Version >= 3.0 <= 3.10.2.1
VMware ≫ Cloud Foundation Version >= 4.0 <= 4.2.1
VMware ≫ Vrealize Operations Manager Version >= 8.0.0 < 8.5.0
VMware ≫ Vrealize Operations Manager Version7.5.0
VMware ≫ Vrealize Suite Lifecycle Manager Version >= 8.0 <= 8.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.32% | 0.548 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.