by Kastro
Paper/Archive/CVE-2022-31706

CVE-2022-31706

vmware — The vRealize Log Insight contains a Directory Traversal Vulnerability.

EPSS 87%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Affected

ProductAffectedFixed inSource
vRealize Log Insight (vRLI)vRealize Log Insight 8.10.1 and prior–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2023-0001.htmlrefpacketstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.htmlexploitpacketstorm.news/files/id/174606