VMware fixes 3 vulnerabilities in its products

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware fixes 3 vulnerabilities in its products

VMware fixes 3 vulnerabilities in the products Spring Boot, Spring Security and Spring Cloud Config. Products and their fixes: Spring Boot - 2.7.25, 3.1.16, 3.2.14, 3.3.11, 3.4.5 [1] Spring Security - 5.7.17, 5.8.19, 6.0.17, 6.1.15, 6.2.11, 6.3.9, 6.4.5 [2] Spring Cloud Config - 4.2.2, 4.1.6, 4.0.10, 3.1.10, 4.1.6, 4.1.6 [3]

VMware Spring Boot - improper input validation (CVE-2025-22235)

CVSS 7.3 (High)

An unauthenticated remote attacker can, due to incorrect configuration of EndpointRequest.to() in Spring Boot, access the unprotected path /null if the referenced endpoint is disabled or not exposed, which may lead to unauthorized access [1].

The vulnerability is present in product:

Spring Boot; >=2.7.0, <=2.7.24.2; >=3.1.0, <=3.1.15.2; >=3.2.0, <=3.2.13.2; >=3.3.0, <=3.3.10; >=3.4.0, <=3.4.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

More information:

CVE-2025-22235 at cve.org, NVD
CWE-20: Improper Input Validation at cwe.mitre.org

The vulnerability was publicly disclosed 24. 4. 2025.

VMware Spring Security - improper access control (CVE-2025-22234)

CVSS 5.3 (Medium)

An unauthenticated remote attacker can, due to incorrect mitigation of timing attacks in the DaoAuthenticationProvider component in Spring Security, determine whether a supplied password belongs to an existing user account [2].

The vulnerability is present in product:

*:Spring Security; =5.7.16; =5.8.18; =6.0.16; =6.1.14; =6.2.10; =6.3.8; =6.4.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2025-22234 at cve.org, NVD
CWE-284: Improper Access Control at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2025.

VMware Spring Cloud Config - improper authentication (CVE-2025-22232)

CVSS 5.3 (Medium)

An unauthenticated remote attacker can, due to improper handling of Vault tokens in Spring Cloud Config Server, gain unauthorized access to sensitive configuration data of other clients [3].

The vulnerability is present in product:

*:Spring Cloud Config; >=2.2.0, <=4.2.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2025-22232 at cve.org, NVD
CWE-287: Improper Authentication at cwe.mitre.org

The vulnerability was publicly disclosed 7. 4. 2025.

Links

By CESNET, z.s.p.o. Michaela Jarošová on 30. 4. 2025.

Report feedback

[TLP:CLEAR] VMware fixes 3 vulnerabilities in its products

VMware Spring Boot - improper input validation (CVE-2025-22235)

CVSS 7.3 (High)

VMware Spring Security - improper access control (CVE-2025-22234)

CVSS 5.3 (Medium)

VMware Spring Cloud Config - improper authentication (CVE-2025-22232)

CVSS 5.3 (Medium)

Links