High severity · published Jul 3, 2016
CVE-2016-2082
Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack the authentication of unspecified victims…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VL
Vrealize Log Insight · Vmware
2.0; 2.0.5; 2.5; 2.5.1; 3.0; 3.0.1; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2082
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2082
www.securitytracker.com
http://www.securitytracker.com/id/1036078
Patch
http://www.vmware.com/security/advisories/VMSA-2016-0008.html
More from Vrealize Log Insight
9.8
CVE-2022-31706
The vRealize Log Insight contains a Directory Traversal Vulnerability
9.8
CVE-2022-31704
The vRealize Log Insight contains a broken access control vulnerability
7.5
CVE-2022-31710
vRealize Log Insight contains a deserialization vulnerability
7.5
CVE-2022-31703
The vRealize Log Insight contains a Directory Traversal Vulnerability
7.2
CVE-2018-6980
VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method