This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware Aria Operations fixes 5 vulnerabilities
VMware fixes 5 vulnerabilities in its products, two of them highly severe [1]. Products and their fixes: VMware Aria Operations for logs - 8.18.3 [1] VMware Aria Operations - 8.18.3 [1] VMware Cloud Foundation - KB92148 [2]
Allows an authenticated remote attacker with "View Only Admin" privileges to read the credentials of a VMware product integrated with VMware Aria Operations for Logs [1].
The vulnerability is present in products:
- *:VMware Aria Operations for logs; >=8.0.0, <8.18.3
- *:VMware Cloud Foundation;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-22218 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2025.
Allows an authenticated remote attacker with non-administrative privileges to inject a malicious script that can perform stored cross-site scripting, and thereby perform arbitrary operations in the context of an administrator [1].
The vulnerability is present in products:
- *:VMware Aria Operations for logs; >=8.0.0, <8.18.3
- *:VMware Cloud Foundation;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-22219 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2025.
Allows an authenticated remote attacker with non-administrative privileges and network access to the Aria Operations for Logs API to perform arbitrary operations in the context of an administrator [1].
The vulnerability is present in products:
- *:VMware Aria Operations for logs; >=8.0.0, <8.18.3
- *:VMware Cloud Foundation;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2025-22220 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2025.
Allows an authenticated remote attacker with administrative privileges to inject a malicious script that may be executed in the victim's browser when performing a delete action in Agent Configuration [1].
The vulnerability is present in products:
- *:VMware Aria Operations for logs; >=8.0.0, <8.18.3
- *:VMware Cloud Foundation;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
More information:
- CVE-2025-22221 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2025.
Allows an authenticated remote attacker with non-administrative privileges to obtain credentials for the output plugin if they know a valid service credential ID [1].
The vulnerability is present in product:
- *:VMware Aria Operations; >=8.0.0, <8.18.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2025-22222 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 5. 2. 2025.