{"id":"CVE-2025-22217","state":"PUBLISHED","title":"Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in aff","description":"Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. \n\nA malicious user with network access may be able to use specially crafted SQL queries to gain database access.","publishedAt":"2025-01-28T18:33:36.486Z","updatedAt":"2026-02-26T19:08:56.525Z","severity":{"score":8.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"vmware"},"assigner":"vmware","products":["N/A VMware AVI Load Balancer"],"affected":[{"vendor":"N/A","product":"VMware AVI Load Balancer","defaultStatus":"unaffected","versions":[{"version":"VMware AVI Load Balancer 30.1.x and VMware AVI Load Balancer 30.2.x and","status":"affected"}]}],"references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25346"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/22xxx/CVE-2025-22217.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22217","state":"PUBLISHED","datePublished":"2025-01-28T18:33:36.486Z","dateUpdated":"2026-02-26T19:08:56.525Z","assignerShortName":"vmware","assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateReserved":"2025-01-02T04:29:30.444Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. \n\nA malicious user with network access may be able to use specially crafted SQL queries to gain database access."}],"affected":[{"vendor":"N/A","product":"VMware AVI Load Balancer","defaultStatus":"unaffected","versions":[{"version":"VMware AVI Load Balancer 30.1.x and VMware AVI Load Balancer 30.2.x and","status":"affected"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25346"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"vmware","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateUpdated":"2025-01-28T18:33:36.486Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-22217","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-01-29T04:55:31.130108Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T19:08:56.525Z"}}]}}}