Security Advisory VMSA-2021-0018

Yesterday VMware released IMPORTANT Security Advisory for vRealize Operations Manager,

Please see below information on VMSA-2021-0018, Important Notes, and Security Patch PAK to address this Security Advisory:

Security Advisory

VMSA-2021-0018 – VMware vRealize Operations update addresses multiple security vulnerabilities (CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027) with a maximum CVSSv3 base score of 8.6.

Known Attack Vectors

An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.

Important Notes

vRealize Operations Manager 8.5 is Unaffected
VMSA-2021-0004 has been updated to reflect this advisory.
Please be sure to take snapshots of each of the vRealize Operations nodes before applying the Security Patch. See How to take a Snapshot of vRealize Operations (2149269) for more information.
Download and run the APUAT-18484177.pak attached to the KB Article to run the Pre-Upgrade Readiness Assessment Tool for this Security Patch. Follow vRealize Operations Pre-Upgrade Readiness Assessment Tools (67311) for the latest instructions.

Security Patch PAK – Patch Portal (to address advisory)