high8.2
CVE-2025-22249
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability.
Impact
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Aria Automation | Versions 8.18.0, 8.18.1 |
| Vmware | Cloud Foundation | from 4.0 through 5.2.1 |
| Vmware | Telco Cloud Platform | from 5.0 through 5.0.1 |