5.4
CVE-2025-22220
- EPSS 0.15%
- Veröffentlicht 30.01.2025 16:15:31
- Zuletzt bearbeitet 14.05.2025 16:46:59
- Quelle security@vmware.com
- CVE-Watchlists
- Unerledigt
VMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)
VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Aria Operations For Logs Version >= 8.0 < 8.18.3
VMware ≫ Cloud Foundation Version >= 4.0 <= 5.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.356 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
|
| security@vmware.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
CWE-269 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.