VMware addressed a high severity vulnerability in vRealize Operations that could allow stealing admin credentials from vulnerable servers.
VMware has published security updates to address multiple vulnerabilities in VMware vRealize Operations that could allow threat actors to steal admin credentials from vulnerable installs.
VMware vRealize Operations is a self-driving and AI-powered platform for the management of IT operations for private, hybrid, and multi-cloud environments. The solution is available as an on-premises or SaaS solution.
The most severe vulnerability, tracked as CVE-2021-21975, is a Server Side Request Forgery in vRealize Operations Manager API, it received a CVSSv3 base score of 8.6.
“The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of ‘Important’ severity with a maximum CVSSv3 base score of 8.6.” reads the advisory published by the virtualization giant.
“A malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.”
A remote, unauthenticated attacker can exploit the vulnerability without user interaction to steal administrative credentials.
The vulnerability was reported to VMware by security researcher Egor Dimitrenko from Positive Technologies.
The company also addressed an arbitrary file write vulnerability in vRealize Operations Manager API tracked as CVE-2021-21983 that received a CVSSv3 base score of 7.2.
“An authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.” reads the advisory published by the company. “To remediate CVE-2021-21983 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.”
Impacted products include:
- VMware vRealize Operations
- VMware Cloud Foundation
- vRealize Suite Lifecycle Manager
VMware also announced the availability of workarounds for customers that can’t immediately install the security updates.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, SSRF)
Share On
Pierluigi Paganini
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at “Cyber Defense Magazine”, Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog “Security Affairs” recently named a Top National Security Resource for US. Pierluigi is a member of the “The Hacker News” team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books “The Deep Dark Web” and “Digital Virtual Currency and Bitcoin”.
VMware addressed a high severity vulnerability in vRealize Operations that could allow stealing admin credentials from vulnerable servers.
VMware has published security updates to address multiple vulnerabilities in VMware vRealize Operations that could allow threat actors to steal admin credentials from vulnerable installs.
VMware vRealize Operations is a self-driving and AI-powered platform for the management of IT operations for private, hybrid, and multi-cloud environments. The solution is available as an on-premises or SaaS solution.
The most severe vulnerability, tracked as CVE-2021-21975, is a Server Side Request Forgery in vRealize Operations Manager API, it received a CVSSv3 base score of 8.6.
“The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of ‘Important’ severity with a maximum CVSSv3 base score of 8.6.” reads the advisory published by the virtualization giant.
“A malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.”
A remote, unauthenticated attacker can exploit the vulnerability without user interaction to steal administrative credentials.
The vulnerability was reported to VMware by security researcher Egor Dimitrenko from Positive Technologies.
The company also addressed an arbitrary file write vulnerability in vRealize Operations Manager API tracked as CVE-2021-21983 that received a CVSSv3 base score of 7.2.
“An authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.” reads the advisory published by the company. “To remediate CVE-2021-21983 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.”
Impacted products include:
- VMware vRealize Operations
- VMware Cloud Foundation
- vRealize Suite Lifecycle Manager
VMware also announced the availability of workarounds for customers that can’t immediately install the security updates.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, SSRF)