High severity · published Nov 13, 2018
CVE-2018-6980
VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method
7.2
CVSS
1.4%
EPSS
No
On KEV
Description
VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VL
Vrealize Log Insight · Vmware
4.6 before 4.6.2; 4.7 before 4.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6980
Third Party Advisory
http://www.securityfocus.com/bid/105925
Patch
https://www.vmware.com/security/advisories/VMSA-2018-0028.html
More from Vrealize Log Insight
9.8
CVE-2022-31706
The vRealize Log Insight contains a Directory Traversal Vulnerability
9.8
CVE-2022-31704
The vRealize Log Insight contains a broken access control vulnerability
8.8
CVE-2016-2082
Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack the authentication of unspecified victims…
7.5
CVE-2022-31710
vRealize Log Insight contains a deserialization vulnerability
7.5
CVE-2022-31703
The vRealize Log Insight contains a Directory Traversal Vulnerability