CVE-2025-41228 — VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability

Description (CNA)

VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.

Affected (CNA)

Vendor / product	Versions
VMware / vCenter Server	affected 8.0 before 8.0 U3e
VMware / Cloud Foundation	affected 5.x, 4.5.x
VMware / Telco Cloud Platform	affected 5.x, 4.x, 3.x, 2.x
VMware / Telco Cloud Infrastructure	affected 3.x,2.x
VMware / ESXi	affected 8.0 before ESXi80U3se-24659227; affected 7.0 before ESXi70U3sv-24723868

CWE

CWE-79

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.