Vulnerability · Published Aug 30, 2021 · Assigned by vmware
CVE-2021-22021
Medium 5.4
In plain English
A medium-severity security flaw in VMware vRealize Log Insight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vRealize Log Insight | VMware vRealize Log Insight (8.x prior to 8.4) |
References
- https://www.vmware.com/security/advisories/VMSA-2021-0019.html x_refsource_MISC