• VMware vRealize Operations
• VMware Cloud Foundation (Cloud Foundation) 
• vRealize Suite Lifecycle Manager

Multiple vulnerabilities in VMware vRealize Operations were privately reported to VMware. Patches and Workarounds are available to address these vulnerabilities in impacted VMware products. 

The vRealize Operations Manager API contains an arbitrary file read vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.

A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure.

To remediate CVE-2021-22022 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

None.

An FAQ to document general queries was created which is listed in the 'Additional Documentation' column of the 'Response Matrix' below.

None.

VMware would like to thank Egor Dimitrenko of Positive Technologies for reporting this vulnerability to us.

The vRealize Operations Manager API has insecure object reference vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.6.

A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover.

To remediate CVE-2021-22023 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

None.

An FAQ to document general queries was created which is listed in the 'Additional Documentation' column of the 'Response Matrix' below.

None.

VMware would like to thank Egor Dimitrenko of Positive Technologies for reporting this vulnerability to us.

The vRealize Operations Manager API contains an arbitrary log-file read vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.

An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.

To remediate CVE-2021-22024 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

None.

An FAQ to document general queries was created which is listed in the 'Additional Documentation' column of the 'Response Matrix' below.

None.

VMware would like to thank thiscodecc of MoyunSec V-Lab for reporting this vulnerability to us.

The vRealize Operations Manager API contains a broken access control vulnerability leading to unauthenticated API access. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.6.

An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.

To remediate CVE-2021-22025 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

None.

An FAQ to document general queries was created which is listed in the 'Additional Documentation' column of the 'Response Matrix' below.

None.

VMware would like to thank thiscodecc of MoyunSec V-Lab for reporting this vulnerability to us.

The vRealize Operations Manager API contains a Server Side Request Forgery in multiple end points. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.

An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.

To remediate CVE-2021-22026 and CVE-2021-22027 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to impacted deployments.

None.

An FAQ to document general queries was created which is listed in the 'Additional Documentation' column of the 'Response Matrix' below.

None.

VMware would like to thank thiscodecc of MoyunSec V-Lab for reporting this vulnerability to us.

Fixed Versions:

vRealize Operations Manager

8.4: https://kb.vmware.com/s/article/85383

8.3: https://kb.vmware.com/s/article/85382

8.2: https://kb.vmware.com/s/article/85381

8.1.1: https://kb.vmware.com/s/article/85380

8.0.1: https://kb.vmware.com/s/article/85379

7.5: https://kb.vmware.com/s/article/85378

VMware Cloud Foundation (vROps)

4.x/3.x: https://kb.vmware.com/s/article/85452

vRealize Suite Lifecycle Manager (vROps)

8.x: https://kb.vmware.com/s/article/85452

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22022

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22023

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22024

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22025

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22026

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22027

FIRST CVSSv3 Calculator:

CVE-2021-22022 : https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CVE-2021-22023 : https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2021-22024 : https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2021-22025 : https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVE-2021-22026 : https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2021-22027 : https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

2021-08-24 VMSA-2021-0018
Initial security advisory.

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

This Security Advisory is posted to the following lists:  

[email protected]  

[email protected]  

[email protected] 

E-mail: [email protected]

PGP key at:

https://kb.vmware.com/kb/1055 

VMware Security Advisories

https://www.vmware.com/security/advisories 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

Twitter

https://twitter.com/VMwareSRC

Copyright 2021 VMware Inc. All rights reserved.