CVE-2025-22219 is a critical stored cross-site scripting (XSS) vulnerability affecting VMware Aria Operations for Logs and VMware Cloud Foundation. A non-administrative attacker can inject malicious scripts, potentially leading to arbitrary operations as an administrator. With a CVSS score of 9.0 (Critical), this vulnerability has a low attack complexity and requires user interaction, but can result in high impact to confidentiality, integrity, and availability. There is currently no evidence of active exploitation, and public exploit code is unavailable, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.0, < 8.18.3CPE matchmatch criteria | cpe:2.3:a:vmware:aria_operations_for_logs:*:*:*:*:*:*:*:* | ||
>= 4.0, <= 5.2CPE matchmatch criteria | cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.6 Bluesky, 0.3 Mastodon, and 1.6 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Multiple vulnerabilities in VMware Aria Operations for logs and VMware Aria Operations
Jan 1, 2025Multiple vulnerabilities in VMware Aria Operations for Logs and VMware Aria Operations (VMSA-2025-0003)
Multiple vulnerabilities in VMware Aria Operations for Logs and VMware Aria Operations (VMSA-2025-0003)