by Kastro
Paper/Archive/CVE-2022-31704

CVE-2022-31704

vmware — The vRealize Log Insight contains a broken access control vulnerability.

EPSS 81%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.6.996 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.

Affected

ProductAffectedFixed inSource
vRealize Log Insight (vRLI)vRealize Log Insight 8.10.1 and prior–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2023-0001.htmlrefpacketstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.htmlexploitpacketstorm.news/files/id/174606