MEDIUM
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
Published Sep 29, 2025
4.9
MEDIUMCVSS 3.1
EPSS 0.61%
Description
VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.
Affected products
-
- Version 8.18.xStatusaffectedConstraints<8.18.5
- Version
-
- Version 4.xStatusaffectedConstraints<8.18.5
- Version 5.xStatusaffectedConstraints<8.18.5
- Version
-
- Version 2.xStatusaffectedConstraints<8.18.5
- Version 3.xStatusaffectedConstraints<8.18.5
- Version
-
- Version 4.xStatusaffectedConstraints<8.18.5
- Version 5.xStatusaffectedConstraints<8.18.5
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | VMware Aria Operations | unaffected |
| |||||||||
| VMware | VMware Cloud Foundation | unaffected |
| |||||||||
| VMware | VMware Telco Cloud Infrastructure | unaffected |
| |||||||||
| VMware | VMware Telco Cloud Platform | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31588 Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner vmware
Published Sep 29, 2025
Updated Sep 30, 2025
Reserved Apr 16, 2025
Link CVE-2025-41245
CISA Vulnrichment
Updated Sep 30, 2025
ENISA EUVD
EUVD-2025-31588 Assigner vmware
Published Sep 29, 2025
Updated Sep 30, 2025
Exploited since n/a
Link EUVD-2025-31588