CVE-2025-22215

VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

State: Published
Severity: 4.3 Medium
Published: Jan 8, 2025
Updated: Jan 8, 2025
Reserved: Jan 2, 2025

Description

VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	vmware

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
VMware Aria AutomationVMware	8.x to before 8.18.1 patch 1Affected
VMware Cloud Foundation (VMware Aria Automation)VMware	5.x to before 8.18.1 patch 1Affected 4.x to before 8.18.1 patch 1Affected

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25312

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.