Read the docs
TI-2018-05102 Aliases CVE-2018-6980GHSA-pvc9-qr25-w7jc

Incorrect authorization in VMware vRealize Log Insight

Priority LOW 35CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.

Why it matters now

EPSS 0.01438 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareVMware vRealize Log InsightVVMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2)—No fix listedCNA
  • VMware vRealize Log Insight VendorVMware Affected VVMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*4.6 to before 4.6.2; 4.7 to before 4.7.1VulnerableVMware
  • cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:* Versions 4.6 to before 4.6.2; 4.7 to before 4.7.1 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6980
  2. 2026-10-03 Alias added: GHSA-pvc9-qr25-w7jc

References

Patch 1

  • TI-2022-13624 Path traversal in vRealize Log Insight CVSS 3.1CRITICAL 9.8
  • TI-2022-13622 Improper access control in vRealize Log Insight CVSS 3.1CRITICAL 9.8
  • TI-2022-13628 Information disclosure in vRealize Log Insight CVSS 3.1MEDIUM 5.3
  • TI-2022-13621 Path traversal in vRealize Log Insight CVSS 3.1HIGH 7.5
  • TI-2022-13627 Deserialization of untrusted data in vRealize Log Insight CVSS 3.1HIGH 7.5
  • TI-2016-01912 Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences