CVE-2021-22036

2021-10-1315:52:00

vmware

www.cve.org

vmware

vrealize orchestrator

open redirect

vulnerability

improper path handling

sensitive information disclosure

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.

CNA Affected

[
  {
    "product": "VMware vRealize Orchestrator",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "VMware vRealize Orchestrator (8.x prior to 8.6)"
      }
    ]
  }
]

References

www.vmware.com/security/advisories/VMSA-2021-0023.html