Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2025-22249

VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

VMware Vmware Aria Automation

Default version status: unaffected

  • 8.18.x to < 8.18.1 patch2affected

VMware VMware Cloud Foundation

Default version status: unaffected

  • 5.x to < 8.18.1 patch 2affected
  • 4.x to < 8.18.1 patch 2affected

VMware VMware Telco Cloud Platform

Default version status: unaffected

  • 5.x to < 8.18.1 patch 2affected

References