CVE-2021-22036

Published: Oct 13, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.

Affected (2)

Products: Vmware: Vrealize Automation, Vrealize Orchestrator

2 products

Vrealize Automation

Vrealize Orchestrator

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Vrealize Automation	From 8.0 to 8.6
Vmware Vrealize Orchestrator	From 8.0 to 8.6

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://www.vmware.com/security/advisories/VMSA-2021-0023.html

Source: security@vmware.com

Vendor Advisory

https://www.vmware.com/security/advisories/VMSA-2021-0023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.