VMware fixes four serious vRealize vulnerabilities
Two of the flaws were given a 9.8 severity score
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Virtualization giant VMware has released patches for four vulnerabilities in its vRealize Log Insight product, two of which have a “critical” severity rating.
The critical pair are CVE-2022-31703 and CVE-2022-31704. The former is a directory traversal vulnerability, while the latter is a broken access control vulnerability. Both were given a 9.8 severity score, and both allow threat actors to access resources that should otherwise be inaccessible.
“An unauthenticated, malicious actor can inject files into theoperating systemof an impacted appliance which can result in remote code execution,” VMware explained.
TechRadar Pro needs you!We want to build a better website for our readers, and we need your help! You can do your bit by filling outour surveyand telling us your opinions and views about the tech industry in 2023. It will only take a few minutes and all your answers will be anonymous and confidential. Thank you again for helping us make TechRadar Pro even better.
D. Athow, Managing Editor
Sensitive data at risk
The other two flaws are CVE-2022-31710 and CVE-2022-31711. The former is a deserialization vulnerability that allows threat actors to tamper with data and launch denial-of-service attacks. It’s been given a 7.5 severity score. The latter is a 5.3-scored information disclosure bug that can be leveraged to steal sensitive data.
To protect against the flaws, users are advised to apply the patch immediately, and bring theirendpointsto version 8.10.2. Those that cannot apply the patch right now can also apply the workaround, for which the instructions can be foundhere.
Known VMware flaw abused to distribute ransomware>These critical VMware security flaws must be patched now>Remove viruses and ransomware with the best malware removal
The flaws were originally discovered by the Zero Day Initiative, the publication confirmed. The program’s members said that so far, there is no evidence of the flaws being abused in the wild.
“We’re not aware of any public exploit code or active attacks using this vulnerability,” Dustin Childs, head of threat awareness at Trend Micro’s ZDI, toldThe Register. “While we have no current plans to publish proof of concept for this bug, our research in VMware and other virtualization technologies continues.”
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
vRealize Log Insight is a log management tool. Although it’s not as popular as some of VMware’s other solutions, the company’s presence in both the public and private sectors most likely makes all of its products an attractive target for cybercriminals looking for vulnerabilities.
Via:The Register
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
This super-cheap HP Victus 15 gaming laptop just dropped to its lowest price yet
