7.7
CVE-2025-22222
- EPSS 0.65%
- Veröffentlicht 30.01.2025 16:15:31
- Zuletzt bearbeitet 14.05.2025 16:47:55
- Quelle security@vmware.com
- CVE-Watchlists
- Unerledigt
VMware Aria Operations information disclosure vulnerability (CVE-2025-22222)
VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Aria Operations Version >= 8.0 < 8.18.3
VMware ≫ Cloud Foundation Version >= 4.0 <= 5.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.65% | 0.706 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| security@vmware.com | 7.7 | 3.1 | 4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
|
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.