VMware Aria Automation Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in VMware Aria Automation. This vulnerability allows a malicious actor with 'Organization Member' access to enumerate internal services running on the host or network. The issue is present in VMware Aria Automation version 8.x and affects VMware Cloud Foundation versions 5.x and 4.x.

Impact

Exploitation of this vulnerability could lead to unauthorized enumeration of internal services on the host or network, potentially allowing for further attacks or exploitation of other vulnerabilities.

Remediation

To address this vulnerability, users should apply the patches available for VMware Aria Automation 8.18.1 patch 1 or consult Knowledge Base article 385294 for VMware Cloud Foundation.