VMware Issues Patches to Fix New Flaws Affecting Multiple Products

VMware on Wednesday shipped security updates^[1]
to address vulnerabilities in multiple products that could be
potentially exploited by an attacker to take control of an affected
system.

The six security weaknesses (from CVE-2021-22022 through
CVE-2021-22027, CVSS scores: 4.4 – 8.6) affect VMware vRealize
Operations (prior to version 8.5.0), VMware Cloud Foundation
(versions 3.x and 4.x), and vRealize Suite Lifecycle Manager
(version 8.x), as listed below –

• CVE-2021-22022 (CVSS score: 4.4) – Arbitrary
  file read vulnerability in vRealize Operations Manager API, leading
  to information disclosure
• CVE-2021-22023 (CVSS score: 6.6) – Insecure
  direct object reference vulnerability in vRealize Operations
  Manager API, enabling an attacker with administrative access to
  alter other users’ information and seize control of an account
• CVE-2021-22024 (CVSS score: 7.5) – Arbitrary
  log-file read vulnerability in vRealize Operations Manager API,
  resulting in sensitive information disclosure
• CVE-2021-22025 (CVSS score: 8.6) – Broken
  access control vulnerability in vRealize Operations Manager API,
  allowing an unauthenticated malicious actor to add new nodes to the
  existing vROps cluster
• CVE-2021-22026 and CVE-2021-22027 (CVSS score:
  7.5) – Server Side Request Forgery vulnerability in vRealize
  Operations Manager API, leading to information disclosure

Credited with reporting the flaws are Egor Dimitrenko of
Positive Technologies (CVE-2021-22022 and CVE-2021-22023) and
thiscodecc of MoyunSec V-Lab (from CVE-2021-22024 to
CVE-2021-22027).

Separately, VMware has also issued patches to remediate a
cross-site scripting (XSS) vulnerability impacting VMware vRealize
Log Insight and VMware Cloud Foundation that stems from a case of
improper user input validation, enabling an adversary with user
privileges to inject malicious payloads via the Log Insight UI
that’s executed when a victim accesses the shared dashboard
link.

The flaw, which has been assigned the identifier CVE-2021-22021^[2], has been rated 6.5 for
severity on the CVSS scoring system. Marcin Kot of Prevenity and
Tran Viet Quang of Vantage Point Security have been credited for
independently discovering and reporting the vulnerability.

The patches also arrive a week after VMware patched a
denial-of-service bug in its VMware Workspace ONE UEM console
(CVE-2021-22029^[3], CVSS score: 5.3) that
an actor with access to “/API/system/admins/session” could abuse to
render the API unavailable due to improper rate limiting.