CVE-2022-31710

2023-01-2621:15:38

CWE-502

[email protected]

web.nvd.nist.gov

cve-2022-31710

vrealize log insight

deserialization vulnerability

unauthenticated

remote exploit

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.2%

JSON

vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.

Affected configurations

NVD

Node

vmwarevrealize_log_insightRange3.0–4.8

vmwarevrealize_log_insightRange8.0.0–8.10.2

CPENameOperatorVersion
vmware:vrealize_log_insightvmware vrealize log insightle4.8
vmware:vrealize_log_insightvmware vrealize log insightlt8.10.2

CPE	Name	Operator	Version
vmware:vrealize_log_insight	vmware vrealize log insight	le	4.8
vmware:vrealize_log_insight	vmware vrealize log insight	lt	8.10.2

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "vRealize Log Insight (vRLI)",
    "versions": [
      {
        "version": "vRealize Log Insight 8.10.1 and prior",
        "status": "affected"
      }
    ]
  }
]