The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.
| Software | From | Fixed in |
|---|---|---|
| vmware / vrealize_operations | 6.1.0 | 6.1.0.x |
| vmware / vrealize_operations | 6.0.0 | 6.0.0.x |
| vmware / vrealize_operations | 6.2.0a | 6.2.0a.x |
| vmware / vrealize_operations | 6.2.1 | 6.2.1.x |
| vmware / vrealize_operations | 6.3.0 | 6.3.0.x |