VMware vRealize Operations Manager Impacted by SaltStack Vulnerabilities

Summary

Two vulnerabilities discovered in SaltStack’s Salt project, authentication bypass vulnerability CVE-2020-11651 and directory traversal vulnerability CVE-2020-11652 , affect the Application Remote Controller (ARC) in VMware vRealize Operations Manager. Exploitation of CVE-2020-11651 could allow a threat actor to take control of the ARC and any virtual machines in the ARC with a Telegraf agent, and exploitation of CVE-2020-11652 could allow a threat actor to access the entire ARC filesystem. Updates to mitigate the vulnerabilities are forthcoming.

Recommendations

The NJCCIC recommends users and administrators of VMware’s vRealize Operations Manager apply the workarounds provided by VMware and apply updates when they become available after appropriate testing. More information can be found in the VMware Security Advisory.