CVE-2025-41245

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41245", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2025-04-16T09:30:25.625Z", "datePublished": "2025-09-29T16:19:15.836Z", "dateUpdated": "2025-09-30T15:42:32.121Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMware Aria Operations", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "8.18.x", "versionType": "commercial"}]}, {"defaultStatus": "unaffected", "product": "VMware Cloud Foundation", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "5.x", "versionType": "commercial"}, {"lessThan": "8.18.5", "status": "affected", "version": "4.x", "versionType": "commercial"}]}, {"defaultStatus": "unaffected", "product": "VMware Telco Cloud Platform", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "5.x", "versionType": "commercial"}, {"lessThan": "8.18.5", "status": "affected", "version": "4.x", "versionType": "commercial"}]}, {"defaultStatus": "unaffected", "product": "VMware Telco Cloud Infrastructure", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "3.x", "versionType": "commercial"}, {"lessThan": "8.18.5", "status": "affected", "version": "2.x", "versionType": "commercial"}]}], "datePublic": "2025-09-29T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">VMware Aria Operations contains an information disclosure vulnerability.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.</span></span><br>"}], "value": "VMware Aria Operations contains an information disclosure vulnerability.\u00a0A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1188", "description": "CWE-1188", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-09-29T16:19:15.836Z"}, "references": [{"url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149"}], "source": {"discovery": "UNKNOWN"}, "title": "VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T15:42:25.242190Z", "id": "CVE-2025-41245", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:42:32.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41245", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T15:42:25.242190Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:42:29.344Z"}}], "cna": {"title": "VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "VMware Aria Operations", "versions": [{"status": "affected", "version": "8.18.x", "lessThan": "8.18.5", "versionType": "commercial"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "VMware Cloud Foundation", "versions": [{"status": "affected", "version": "5.x", "lessThan": "8.18.5", "versionType": "commercial"}, {"status": "affected", "version": "4.x", "lessThan": "8.18.5", "versionType": "commercial"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "VMware Telco Cloud Platform", "versions": [{"status": "affected", "version": "5.x", "lessThan": "8.18.5", "versionType": "commercial"}, {"status": "affected", "version": "4.x", "lessThan": "8.18.5", "versionType": "commercial"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "VMware Telco Cloud Infrastructure", "versions": [{"status": "affected", "version": "3.x", "lessThan": "8.18.5", "versionType": "commercial"}, {"status": "affected", "version": "2.x", "lessThan": "8.18.5", "versionType": "commercial"}], "defaultStatus": "unaffected"}], "datePublic": "2025-09-29T16:00:00.000Z", "references": [{"url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "VMware Aria Operations contains an information disclosure vulnerability.\u00a0A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">VMware Aria Operations contains an information disclosure vulnerability.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.</span></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-09-29T16:19:15.836Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41245", "state": "PUBLISHED", "dateUpdated": "2025-09-30T15:42:32.121Z", "dateReserved": "2025-04-16T09:30:25.625Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2025-09-29T16:19:15.836Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VMware Aria Operations", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "8.18.x", "versionType": "commercial"}]}, {"defaultStatus": "unaffected", "product": "VMware Cloud Foundation", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "5.x", "versionType": "commercial"}, {"lessThan": "8.18.5", "status": "affected", "version": "4.x", "versionType": "commercial"}]}, {"defaultStatus": "unaffected", "product": "VMware Telco Cloud Platform", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "5.x", "versionType": "commercial"}, {"lessThan": "8.18.5", "status": "affected", "version": "4.x", "versionType": "commercial"}]}, {"defaultStatus": "unaffected", "product": "VMware Telco Cloud Infrastructure", "vendor": "VMware", "versions": [{"lessThan": "8.18.5", "status": "affected", "version": "3.x", "versionType": "commercial"}, {"lessThan": "8.18.5", "status": "affected", "version": "2.x", "versionType": "commercial"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VMware Aria Operations contains an information disclosure vulnerability.\u00a0A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations."}, {"lang": "es", "value": "VMware Aria Operations contiene una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n. Un actor malicioso con privilegios no administrativos en Aria Operations puede explotar esta vulnerabilidad para revelar credenciales de otros usuarios de Aria Operations."}], "id": "CVE-2025-41245", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41245", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T15:42:25.242190Z", "version": "2.0.3"}}]}, "published": "2025-09-29T17:15:31.000", "references": [{"source": "security@vmware.com", "url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "security@vmware.com", "type": "Secondary"}]}

{}

{"created": "2025-09-30T08:47:54.464113+00:00", "updated": "2025-09-30T08:47:54.464177+00:00", "vendors": ["vmware", "vmware$PRODUCT$aria_operations", "vmware$PRODUCT$cloud_foundation", "vmware$PRODUCT$tools"]}