CVE-2018-6980 Missing authorization in VMware vRealize Log Insight

What is CVE-2018-6980?

CVE-2018-6980 is a high-severity missing authorization vulnerability in VMware vRealize Log Insight, published on 13 Nov 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.

Weakness: CWE-863

Which versions are affected by CVE-2018-6980?

It affects 1 product.

Products include Vmware Vrealize Log Insight.

How do I fix CVE-2018-6980?

No fix has been published for CVE-2018-6980 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-6980 being exploited?

There is no known exploitation of CVE-2018-6980 in the wild and no public exploit code.

Other vulnerabilities in VMware vRealize Log Insight

• CVE-2022-31704 Missing authorization in vRealize Log Insight (vRLI) Critical 9.8
• CVE-2022-31706 Path traversal in vRealize Log Insight (vRLI) Critical 9.8
• CVE-2016-2082 Cross-site request forgery in n/a High 8.8
• CVE-2022-31710 Deserialization in vRealize Log Insight (vRLI) High 7.5
• CVE-2022-31703 Path traversal in vRealize Log Insight (vRLI) High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pvc9-qr25-w7jc.