CVE-2021-22035

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	VMware vRealize Log Insight	VMware vRealize Log Insight (8.x prior to 8.6)

References

https://www.vmware.com/security/advisories/VMSA-2021-0022.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2021-0022.htmlPatch, Vendor Advisory

Timeline

Published: Oct 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-220366.5VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor ma CVE-2021-220377.8Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the co CVE-2021-220388.8On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller ex CVE-2021-22045.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-220406.7VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local adminis CVE-2021-220416.7VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administr CVE-2021-220427.8VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor wit CVE-2021-220437.5VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious acto CVE-2021-220447.5In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@Re CVE-2021-220457.8VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.CVE-2021-220475.3In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers CVE-2021-220488.8The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A