The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.
Weakness
The product writes sensitive information to a log file.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud_foundation | Vmware | 3.0 (including) | 3.10.2.1 (including) |
| Cloud_foundation | Vmware | 4.0 (including) | 4.2.1 (including) |
| Vrealize_operations_manager | Vmware | 8.0.0 (including) | 8.5.0 (excluding) |
| Vrealize_operations_manager | Vmware | 7.5.0 (including) | 7.5.0 (including) |
| Vrealize_suite_lifecycle_manager | Vmware | 8.0 (including) | 8.2 (including) |