The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.
The product writes sensitive information to a log file.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud_foundation | Vmware | 3.0 (including) | 3.10.2.1 (including) |
| Cloud_foundation | Vmware | 4.0 (including) | 4.2.1 (including) |
| Vrealize_operations_manager | Vmware | 8.0.0 (including) | 8.5.0 (excluding) |
| Vrealize_operations_manager | Vmware | 7.5.0 (including) | 7.5.0 (including) |
| Vrealize_suite_lifecycle_manager | Vmware | 8.0 (including) | 8.2 (including) |