CVE-2025-41245 is an information disclosure vulnerability in VMware Aria Operations, allowing a non-administrative attacker to disclose credentials of other users. Rated Medium with a CVSS score of 4.9, this vulnerability requires high privileges but has a low attack complexity and no user interaction, potentially leading to significant confidentiality impact. While there is no known active exploitation or public exploit code, the vulnerability has garnered notable community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| VMware | VMware Aria Operations | >= 8.18.x, < 8.18.5CNA affecteddefault unaffected | |
| VMware | VMware Cloud Foundation | >= 4.x, < 8.18.5, >= 5.x, < 8.18.5CNA affecteddefault unaffected | |
| VMware | VMware Telco Cloud Infrastructure | >= 2.x, < 8.18.5, >= 3.x, < 8.18.5CNA affecteddefault unaffected | |
| VMware | VMware Telco Cloud Platform | >= 4.x, < 8.18.5, >= 5.x, < 8.18.5CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.