CVE-2021-21983

Name of the Vulnerable Software and Affected Versions vRealize Operations versions prior to 8.4

Description The issue is related to an uncontrolled upload of dangerous file types in the vRealize Operations API interface. This could allow a remote attacker to upload malicious files. An authenticated malicious actor with network access to the vRealize Operations Manager API may be able to write files to arbitrary locations on the underlying photon operating system.

Recommendations For versions prior to 8.4, update to version 8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vRealize Operations Manager API to minimize the risk of exploitation. Avoid using the API for file uploads until the issue is resolved.