CVE-2022-31710

{"id": "CVE-2022-31710", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-01-26T21:15:38.037", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2023-0001.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service."}, {"lang": "es", "value": "vRealize Log Insight contiene una vulnerabilidad de deserializaci\u00f3n. Un actor malicioso no autenticado puede desencadenar de forma remota la deserializaci\u00f3n de datos que no son de confianza, lo que podr\u00eda provocar una denegaci\u00f3n de servicio."}], "lastModified": "2023-02-01T16:59:34.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78E848BE-FFD0-40D3-AA72-17E47F616661", "versionEndIncluding": "4.8", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "476F80CF-8F34-402E-9175-E506B844724D", "versionEndExcluding": "8.10.2", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}