This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] VMware NSX fixes 3 vulnerabilities

VMware fixes 3 vulnerabilities in VMware NSX in versions 4.2.2.1, 4.2.1.4 and 4.1.2.6 [1]. If VMware NSX is part of VMware Telco Cloud Infrastructure or VMware Telco Cloud Platform, the patch available at [2] must be applied.

VMware NSX - XSS (CVE-2025-22243)
CVSS 7.5 (High)

An authenticated remote attacker with privileges to create and modify network settings can carry out an XSS attack against a victim viewing the network settings [1].

The vulnerability is present in product:

  • VMware NSX; >=4.2, <4.2.2.1; >=4.2.1, <4.2.1.4; >=4.0, <4.1.2.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H

More information:

  • CVE-2025-22243 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

VMware NSX - XSS (CVE-2025-22244)
CVSS 6.9 (Medium)

An authenticated remote attacker with privileges to create and modify pages intended as a response during URL filtering can carry out an XSS attack against a victim who is shown that page [1].

The vulnerability is present in product:

  • VMware NSX; >=4.2, <4.2.2.1; >=4.2.1, <4.2.1.4; >=4.0, <4.1.2.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

More information:

  • CVE-2025-22244 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

VMware NSX - XSS (CVE-2025-22245)
CVSS 5.9 (Medium)

An authenticated remote attacker with privileges to create and modify router ports can carry out an XSS attack against a victim viewing the details of the router port [1].

The vulnerability is present in product:

  • VMware NSX; >=4.2, <4.2.2.1; >=4.2.1, <4.2.1.4; >=4.0, <4.1.2.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

More information:

  • CVE-2025-22245 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

By CESNET, z.s.p.o. Martin Krajči on 5. 6. 2025.

CESNET, z.s.p.o. Logo