VMware patches two vulnerabilities in vRealize Log Insight, one critical

Just two days after VMware posted an CVSS 10.0- rated patch to VMware vCenter Server issued an advisory covering two additional vulnerabilities, this time in vRealize Log Insight (vRLI) version 8.0.0, 4.x.y.

The vulnerabilities, CVE-2020-3953, CVE-2020-3954, were issued respective CVSS scores of 8.4 (critical) and 6.1 (moderate). VMware recommends updating to version 8.1.0 which contains patches for these vulnerabilities.

CVE-2020-3953 is a cross site scripting (XSS) issue does not properly validate user input, resulting in XSS vulnerabilities. This can be exploited by an actor who has user-level permissions who would be able to add a malicious payload through the Log Insight UI. This malware would then be executed when the victim, who also would have user or admin-level permissions views the data in the UI. This could result in the target’s device being compromised.

CVE-2020-3954 is an open redirect flaw due to improper input validation. To exploit this vulnerability an attacker would send a phishing email containing a seemingly trusted URL. If opened the URL will redirect the victim to a website either created or chosen by the malicious actor where an attempt will be made to compromise that person’s computer.