| Package | Affected versions | Patched versions |
|---|---|---|
| cloud foundation | ≥ 4.0, < 4.3 | 4.3 |
| vrealize log insight | ≥ 4.0, ≤ 4.8≥ 8.0.0, < 8.4 | 8.4 |
VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free