CVE-2021-22035: VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-admi...

Summary

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log In...

What to do

Update vmware vrealize_log_insight to version 8.60 or later.

Affected software

Vendor	Product	Affected versions
vmware	cloud_foundation	>= 4.0.0, <= 4.3.1 `cpe:2.3:a:vmware:cloud_foundation::::::::`
vmware	vrealize_log_insight	> 8.0.0, < 8.60 `cpe:2.3:a:vmware:vrealize_log_insight::::::::`
vmware	vrealize_suite_lifecycle_manager	>= 8.0.0, <= 8.2 `cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager::::::::`

Original advisory text

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-admi...

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.

References

https://www.vmware.com/security/advisories/VMSA-2021-0022.html Patch Vendor Advisory