Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2025-22215

VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

VMware VMware Aria Automation

Default version status: unaffected

  • 8.x to < 8.18.1 patch 1affected

VMware VMware Cloud Foundation (VMware Aria Automation)

Default version status: unaffected

  • 5.x to < 8.18.1 patch 1affected
  • 4.x to < 8.18.1 patch 1affected

References