VulnerabilityAnalyzed

CVE-2025-22221

VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability.

MEDIUM 4.8EPSS 0.40%

Does this matter?

Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.

Description

VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent Configuration.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.40% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: vmware/aria operations for logs · vmware/cloud foundation
Source: security@vmware.com

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.