{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T07:49:23.621","vulnerabilities":[{"cve":{"id":"CVE-2025-22249","sourceIdentifier":"security@vmware.com","published":"2025-05-13T06:15:36.403","lastModified":"2026-06-17T08:45:55.317","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL."},{"lang":"es","value":"La automatización de VMware Aria contiene una vulnerabilidad de Cross Site Scripting (XSS) basada en DOM. Un atacante malicioso podría aprovechar esta vulnerabilidad para robar el token de acceso de un usuario conectado al dispositivo de automatización VMware Aria, engañándolo para que haga clic en una URL maliciosa."}],"affected":[{"source":"security@vmware.com","affectedData":[{"vendor":"VMware","product":"Vmware Aria Automation","defaultStatus":"unaffected","platforms":["any"],"versions":[{"version":"8.18.x","lessThan":"8.18.1 patch2","versionType":"custom","status":"affected"}]},{"vendor":"VMware","product":"VMware Cloud Foundation","defaultStatus":"unaffected","platforms":["any"],"versions":[{"version":"5.x","lessThan":"8.18.1 patch 2","versionType":"custom","status":"affected"},{"version":"4.x","lessThan":"8.18.1 patch 2","versionType":"custom","status":"affected"}]},{"vendor":"VMware","product":"VMware Telco Cloud Platform","defaultStatus":"unaffected","platforms":["any"],"versions":[{"version":"5.x","lessThan":"8.18.1 patch 2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-05-13T13:49:44.097131Z","id":"CVE-2025-22249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:aria_automation:8.18.0:*:*:*:*:*:*:*","matchCriteriaId":"34CB9DCB-C7F6-48CE-B0CD-510B7E9E52D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:aria_automation:8.18.1:-:*:*:*:*:*:*","matchCriteriaId":"BA903210-107C-4005-9EBD-A62609D1081E"},{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:aria_automation:8.18.1:patch1:*:*:*:*:*:*","matchCriteriaId":"5495556A-74A4-4FA2-B48F-55E6B0F5875D"},{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndIncluding":"5.2.1","matchCriteriaId":"E48E9C72-7BD4-4CC7-B44A-B5A017451552"},{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndIncluding":"5.0.1","matchCriteriaId":"3DCC8565-8FB0-4A1D-A761-48B21155A5F6"}]}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25711","source":"security@vmware.com","tags":["Patch","Vendor Advisory"]}]}}]}