Vulnerability · Published Jan 25, 2023 · Assigned by vmware
CVE-2022-31711
Medium 5.3
In plain English
A medium-severity information exposure in vRealize Log Insight (vRLI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 22.3% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)22.3%top 2.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Metasploit, Nuclei
Official description
VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | vRealize Log Insight (vRLI) | vRealize Log Insight 8.10.1 and prior |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N