Tracker / CVE-2025-22249
CVE-2025-22249
High 8.2
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.
Affected products and versions
| vmware | aria_automation |
|---|---|
| vmware | cloud_foundation · 4.0 → 5.2.1 |
| vmware | telco_cloud_platform · 5.0 → 5.0.1 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.