CVE-2025-41245

Full vulnerability record from the local CVENow database.
Description

VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.
Severity
MEDIUM
CVSS score
4.9 (v3.1)
Vulnerability status
Deferred
Source identifier
[email protected]
Published
2025-09-29 17:15:31
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
  "id": "CVE-2025-41245",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T17:15:31.000",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations."
    },
    {
      "lang": "es",
      "value": "VMware Aria Operations contiene una vulnerabilidad de revelación de información. Un actor malicioso con privilegios no administrativos en Aria Operations puede explotar esta vulnerabilidad para revelar credenciales de otros usuarios de Aria Operations."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "VMware Aria Operations",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.18.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "VMware Cloud Foundation",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            },
            {
              "version": "4.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "VMware Telco Cloud Platform",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            },
            {
              "version": "4.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "VMware Telco Cloud Infrastructure",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            },
            {
              "version": "2.x",
              "lessThan": "8.18.5",
              "versionType": "commercial",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T15:42:25.242190Z",
          "id": "CVE-2025-41245",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149",
      "source": "[email protected]"
    }
  ]
}