CVE-2025-22249 — VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)

CVE-2025-22249

VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249) PUBLISHED

Description (CNA)

VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.

Affected (CNA)

Vendor / product	Versions
VMware / Vmware Aria Automation	affected 8.18.x before 8.18.1 patch2
VMware / VMware Cloud Foundation	affected 5.x before 8.18.1 patch 2; affected 4.x before 8.18.1 patch 2
VMware / VMware Telco Cloud Platform	affected 5.x before 8.18.1 patch 2

CWE

No CWE identifiers supplied.

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25711

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.