Improper Authorization in VMware vRealize Log Insight by VMware
CVE-2018-6980

7.2HIGH

Key Information:

Vendor
Vmware
Status
Vmware Vrealize Log Insight
Vendor
CVE Published:
13 November 2018

Summary

VMware vRealize Log Insight versions 4.7.x prior to 4.7.1 and 4.6.x prior to 4.6.2 exhibit a vulnerability where improper authorization in the user registration method can be exploited. This flaw allows users with view-only permissions to carry out administrative actions that should be restricted, potentially compromising the system's integrity and security.

Affected Version(s)

VMware vRealize Log Insight VVMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2)

References

https://www.vmware.com/security/advisories/VMSA-2018-0028...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/105925
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.