QID 730717

The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. (CVE-2022-31706)
The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.(CVE-2022-31704)
vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.(CVE-2022-31710)
VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication. (CVE-2022-31711)

Affected Versions:
VMware vRealize Log Insight 8.x prior to 8.10.2.

QID Detection Logic(Unauthenticated):
This QID checks for vulnerable instances of VMware vRealize Log Insight Automation by sending a crafted payload to the webserver.

Successful exploitation of the vulnerability may allow remote code execution and complete system compromise.