CVE-2021-22021

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-30 · updated 2026-06-17
Weakness: CWE-79

Description

VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.

Affected products

VMware Cloud Foundation: from 4.0 before 4.3 — fixed in 4.3
VMware vRealize Log Insight: from 4.0 through 4.8; from 8.0.0 before 8.4 — fixed in 8.4
VMware vRealize Log Insight: from VMware vRealize Log Insight (8.x prior through 8.4)

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 4.3; VMware vRealize Log Insight 8.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22021 or the next vulnerability affects your stack