8.2
High
CVE-2025-22249 VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this…
Description
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Aria Automation 8.18 | 8.18.x → latest | No fix stated |
| VMware Cloud Foundation 5 | 5.x → latest | No fix stated |
| VMware Cloud Foundation 4 | 4.x → latest | No fix stated |
| VMware Telco Cloud Platform 5 | 5.x → latest | No fix stated |