PT-2025-4396 · Vmware · Vmware Aria Operations For Logs

Maxime Escourbiac + 2 · Published 2025-01-30 · Updated 2025-05-14 · CVE-2025-22220

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VMware Aria Operations for Logs (affected versions not specified)

Description The issue is related to insecure privilege management in VMware Aria Operations for Logs, allowing a malicious actor with non-administrative privileges and network access to the Aria Operations for Logs API to perform certain operations in the context of an admin user. This is a result of a privilege escalation issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-01354

CVE-2025-22220

Affected Products

Vmware Aria Operations For Logs

References · 11

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-22220 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01354 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-22220 · Security Note
• https://cybersecurity-help.cz/vdb/SB2025013104 · Note
• https://twitter.com/Seifreed/status/1884970457729745288 · Twitter Post
• https://t.me/cvedetector/16793 · Telegram Post
• https://twitter.com/dailycve/status/1922720015654023609 · Twitter Post
• https://twitter.com/CVEnew/status/1884990082328805402 · Twitter Post
• https://t.me/cvenotify/110228 · Telegram Post
• https://twitter.com/CCBalert/status/1885373822381031920 · Twitter Post