← Database

CVE-2025-22249

HIGH CVSS: 8.2 Published: 2025-05-13 Modified: 2026-06-17

Description

VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.

Affected Platforms

Vmware Telco Cloud PlatformVmware Aria AutomationVmware Cloud Foundation

Weakness Type

CWE-79

References