vRealize Operations Manager API - Server-Side Request Forgery Detection

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. !/usr/bin/env python3 -- coding: utf-8 --...

CVE-2021-22022: Improper Limitation of a Pathname to a Restricted Directory

The vRealize Operations Manager API 8.x prior to 8.5 contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure...

PT-2021-4136

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5 Description The issue concerns a Server Side Request Forgery in an endpoint of the vRealize Operations Manager API. An unauthenticated malicious actor with network access can perform a...

PT-2021-4132

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5 Description The issue is related to an arbitrary file read vulnerability in the vRealize Operations Manager API. A malicious actor with administrative access can read any arbitrary file...

CVE-2021-21983

CVE-2021-21983 is an authenticated arbitrary file write vulnerability in the VMware vRealize Operations Manager API (pre-8.4). A network‑accessible attacker can leverage the API to write files to arbitrary locations on the underlying Photon OS, potentially enabling code execution as illustrated i...

CVE-2021-21975

Server Side Request Forgery in vRealize Operations Manager API CVE-2021-21975 prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials. Recent assessments: wvu-r7 at Mar...