Skip to main content

Cloud Foundation CVE-2021-22035

MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2021-10-13 security@vmware.com
Code Injection VMware Cloud Foundation Vrealize Log Insight Vrealize Suite Lifecycle Manager
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 13, 2021 - 16:15 nvd
MEDIUM 4.3

DescriptionNVD

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.

AnalysisAI

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-74. VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment. Affected products include: Vmware Cloud Foundation, Vmware Vrealize Log Insight, Vmware Vrealize Suite Lifecycle Manager. Version information: prior to 8.6.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cloud Foundation

View all
CVE-2021-21985 CRITICAL POC
9.8 May 26

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
CVE-2021-21972 CRITICAL POC
9.8 Feb 24

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Rated critical sev
CVE-2020-3992 CRITICAL POC
9.8 Oct 20

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-
CVE-2021-21975 HIGH POC
7.5 Mar 31

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
CVE-2025-22224 CRITICAL
9.3 Mar 04

VMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrator
CVE-2021-21983 MEDIUM POC
6.5 Mar 31

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authent
CVE-2026-59310 CRITICAL POC
9.8 Jul 30

Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation
CVE-2025-22225 HIGH POC
8.2 Mar 04

VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes,
CVE-2026-22719 HIGH
8.1 Feb 25

VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
CVE-2025-22226 HIGH
7.1 Mar 04

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowi
CVE-2022-22954 CRITICAL POC
9.8 Apr 11

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
CVE-2021-22005 CRITICAL POC
9.8 Sep 23

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Rated critical severity (CV

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2021-22035 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy