medium4.9
CVE-2021-22022
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability.
Impact
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Cloud Foundation | from 3.0 through 3.10.2.1 from 4.0 through 4.2.1 |
| Vmware | Vrealize Operations Manager | from 8.0.0 before 8.5.0 Version 7.5.0 |
| Vmware | Vrealize Suite Lifecycle Manager | from 8.0 through 8.2 |