Improper access control in Broadcom products - CVE-2021-22025

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU56084

Improper access control in Broadcom products - CVE-2021-22025

Published: August 25, 2021


Vulnerability identifier: #VU56084
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22025
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can add new nodes to existing vROps cluster.


Affected software

VMware Cloud Foundation (vROps)
vRealize Suite Lifecycle Manager
VMware vRealize Operations Manager (vROps)
Dell Enterprise Hybrid Cloud

How to mitigate CVE-2021-22025

Install updates from vendor's website.

VMware vRealize Operations Manager (vROps) - addressed in versions 7.5.0-HF15, 8.0.1-HF8, 8.1.1-HF8, 8.2.0-HF7, 8.3.0-HF6, 8.4.0-HF2
Dell Enterprise Hybrid Cloud - update to 4.1.2

External References

Related Security Bulletins