CVE-2022-31704

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

81.01% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-22

Published

2023-01-25

Updated

2025-04-02

Proof-of-concept exploits (2)

• horizon3ai/CVE-2023-3405162★ · 2023-10-20
• horizon3ai/vRealizeLogInsightRCE147★ · 2023-01-31

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31704.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrli_rce.rb

References

• CVE Record
• NVD entry

Related

• CVE-2022-31692
• CVE-2022-31705
• CVE-2022-31691
• CVE-2022-31706
• CVE-2022-31683
• CVE-2022-31711