Support Content Notification - Support Portal

VMSA-2018-0028:VMware vRealize Log Insight updates address an authorization bypass vulnerability

Product/Component

Notification Id

23522

Last Updated

11 November 2018

Initial Publication Date

11 November 2018

Status

CLOSED

Severity

MEDIUM

CVSS Base Score

WorkAround

Affected CVE

CVE-2018-6980

VMSA-2018-0028

VMware vRealize Log Insight updates address an authorization bypass vulnerability

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2018-0028

VMware Security Advisory Severity:

Moderate

VMware Security Advisory Synopsis:

VMware vRealize Log Insight updates address an authorization bypass vulnerability

VMware Security Advisory Issue date:

2018-11-13

VMware Security Advisory Updated on:

2018-11-13 (Initial Advisory)

VMware Security Advisory CVE numbers:

CVE-2018-6980

1. Summary

VMware vRealize Log Insight updates address an authorization bypass vulnerability

2. Relevant Products

VMware vRealize Log Insight (vRLI)

3. Problem Description

vRealize Log Insight improper authorization vulnerability

VMware vRealize Log Insight contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.

VMware would like to thank Piotr Madej of ING Tech Poland for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-6980 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.