Vulnerability · Published Oct 13, 2021 · Assigned by vmware
CVE-2021-22036
Medium 6.5
In plain English
A medium-severity security flaw in VMware vRealize Orchestrator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.9%top 39.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vRealize Orchestrator | VMware vRealize Orchestrator (8.x prior to 8.6) |
References
- https://www.vmware.com/security/advisories/VMSA-2021-0023.html x_refsource_MISC