PT-2025-20732 · Vmware · Vmware Aria Automation

Published 2025-05-12 · Updated 2025-05-18 · CVE-2025-22249

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware Aria automation (affected versions not specified)

Description The issue is a DOM-based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this to steal the access token of a logged-in user by tricking them into clicking a maliciously crafted payload URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-05727

CVE-2025-22249

Affected Products

Vmware Aria Automation

References · 12

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25711 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-22249 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05727 · Security Note
• https://twitter.com/BhanuNaik_2026/status/1921927907363946509 · Twitter Post
• https://twitter.com/CCBalert/status/1922300839818830218 · Twitter Post
• https://twitter.com/ripjyr/status/1922124051125797125 · Twitter Post
• https://twitter.com/CVEnew/status/1922164032540213654 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1922180611550155243 · Twitter Post
• https://twitter.com/cracbot/status/1924057476229627905 · Twitter Post
• https://t.me/latest_high_impact_cve/2348 · Telegram Post
• https://t.me/purp_sec/623 · Telegram Post