Multiple Vulnerabilities Affecting VMware vRealize Log Analysis Tool

VMware has released a security advisory to address multiple vulnerabilities affecting their vRealize Log Insight tool (now known as VMware Aria Operations for Logs).

There are two critical vulnerabilities with a Common Vulnerability Scoring System (CVSS) score of 9.8 out of 10. The vulnerabilities are:

• CVE-2022-31706: A critical directory traversal vulnerability that could allow an unauthenticated malicious actor to perform Remote Code Execution (RCE)

• CVE-2022-31704: A critical broken access control vulnerability that could allow an unauthenticated malicious actor to perform RCE.

The vulnerabilities affect all versions of the VMware vRealize Log Insight tool before v8.10.2.

Users and administrators of affected product versions are advised to update to the latest version immediately.

If the vulnerable product is deployed on a VMware Cloud Foundation environment (v4.x and v3.x), users and administrators are advised to upgrade their cloud environment to v4.4.1 first. Additional information on deploying the update on the cloud environment can be found here. 

More information is available here:

https://www.vmware.com/security/advisories/VMSA-2023-0001.html