| Package | Affected versions | Patched versions |
|---|---|---|
| cloud foundation | ≥ 3.0, ≤ 3.10.2.1≥ 4.0, ≤ 4.2.1 | |
| vrealize operations manager | = 7.5.0≥ 8.0.0, < 8.5.0 | 8.5.0 |
| vrealize suite lifecycle manager | ≥ 8.0, ≤ 8.2 |
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free