Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-22024: The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager A...

CVE-2021-22024 · published 5 years ago

Summary

The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.

What to do

Update vmware vrealize_operations_manager to version 8.5.0 or later.

Affected software

Vendor	Product	Affected versions
vmware	cloud_foundation	>= 3.0, <= 3.10.2.1 >= 4.0, <= 4.2.1 `cpe:2.3:a:vmware:cloud_foundation::::::::`
vmware	vrealize_operations_manager	>= 8.0.0, < 8.5.0 7.5.0 `cpe:2.3:a:vmware:vrealize_operations_manager::::::::`
vmware	vrealize_suite_lifecycle_manager	>= 8.0, <= 8.2 `cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager::::::::`

Original advisory text

References

https://www.vmware.com/security/advisories/VMSA-2021-0018.html Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-532Insertion of Sensitive Information into Log File

Timeline

Published30 Aug 2021

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2021-22024 · NVD

Track software like this

Free during beta