This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware fixes a high-severity vulnerability

VMware fixes a vulnerability in VMware Aria Automation and VMware Telco Cloud Platform products with version 8.18.1 patch 2 [1]. For VMware Cloud Foundation, follow KB394224 [2].

VMware Aria Automation, VMware Cloud Foundation, VMware Telco Cloud Platform - XSS (CVE-2025-22249)
CVSS 8.2 (High)

An unauthenticated remote attacker can, due to insufficient input validation, steal the access token of a logged-in user by tricking the user into clicking a maliciously crafted link [1].

The vulnerability is present in products:

  • *:VMware Aria Automation; >=8.18.0, <8.18.1 patch 2
  • *:VMware Cloud Foundation;
  • *:VMware Telco Cloud Platform; >=5.0, <8.18.1 patch 2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

More information:

  • CVE-2025-22249 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 5. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 14. 5. 2025.

CESNET, z.s.p.o. Logo