CVE-2021-22035: vmware cloud_foundation Injection

Vulnerability summary

CVE-2021-22035 is a medium (CVSS 4.3) Injection vulnerability in vmware cloud_foundation. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities.

Timeline

1. 13-10-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.