CVE-2022-31702

2022-12-1419:15:13

CWE-77

vmware

web.nvd.nist.gov

vrealize network insight

vrni

cve-2022-31702

command injection

vulnerability

rest api

unauthenticated access

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication.

Affected configurations

Nvd

Node

vmwarevrealize_network_insightMatch6.2.0

vmwarevrealize_network_insightMatch6.3.0

vmwarevrealize_network_insightMatch6.4.0

vmwarevrealize_network_insightMatch6.5.1

vmwarevrealize_network_insightMatch6.6.0

vmwarevrealize_network_insightMatch6.7.0

VendorProductVersionCPE
vmwarevrealize_network_insight6.2.0cpe:2.3:a:vmware:vrealize_network_insight:6.2.0:*:*:*:*:*:*:*
vmwarevrealize_network_insight6.3.0cpe:2.3:a:vmware:vrealize_network_insight:6.3.0:*:*:*:*:*:*:*
vmwarevrealize_network_insight6.4.0cpe:2.3:a:vmware:vrealize_network_insight:6.4.0:*:*:*:*:*:*:*
vmwarevrealize_network_insight6.5.1cpe:2.3:a:vmware:vrealize_network_insight:6.5.1:*:*:*:*:*:*:*
vmwarevrealize_network_insight6.6.0cpe:2.3:a:vmware:vrealize_network_insight:6.6.0:*:*:*:*:*:*:*
vmwarevrealize_network_insight6.7.0cpe:2.3:a:vmware:vrealize_network_insight:6.7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	vrealize_network_insight	6.2.0	cpe:2.3:a:vmware:vrealize_network_insight:6.2.0:::::::*
vmware	vrealize_network_insight	6.3.0	cpe:2.3:a:vmware:vrealize_network_insight:6.3.0:::::::*
vmware	vrealize_network_insight	6.4.0	cpe:2.3:a:vmware:vrealize_network_insight:6.4.0:::::::*
vmware	vrealize_network_insight	6.5.1	cpe:2.3:a:vmware:vrealize_network_insight:6.5.1:::::::*
vmware	vrealize_network_insight	6.6.0	cpe:2.3:a:vmware:vrealize_network_insight:6.6.0:::::::*
vmware	vrealize_network_insight	6.7.0	cpe:2.3:a:vmware:vrealize_network_insight:6.7.0:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "VMware vRealize Network Insight (vRNI)",
    "versions": [
      {
        "version": "6.x",
        "status": "affected"
      }
    ]
  }
]