CVE-2025-41229 - Vulnerability Details - OpenCVE

VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733

History

Tue, 24 Jun 2025 08:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 20 May 2025 13:15:00 +0000

Type	Values Removed	Values Added
Description		VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.
Title		VMware Cloud Foundation Directory Traversal Vulnerability
Weaknesses		CWE-22
References		https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2025-05-20T12:53:57.430Z

Updated: 2025-06-24T14:57:39.945Z

Reserved: 2025-04-16T09:29:46.972Z

Link: CVE-2025-41229

Vulnrichment

Updated: 2025-05-20T13:23:36.341Z

NVD

Status : Awaiting Analysis

Published: 2025-05-20T13:15:47.807

Modified: 2025-05-21T20:25:16.407

Link: CVE-2025-41229

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41229", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2025-04-16T09:29:46.972Z", "datePublished": "2025-05-20T12:53:57.430Z", "dateUpdated": "2025-06-24T14:57:39.945Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cloud Foundation", "vendor": "VMware", "versions": [{"lessThan": "5.2.1.2", "status": "affected", "version": "5.x", "versionType": "custom"}, {"status": "affected", "version": "4.5.x"}]}], "datePublic": "2025-05-20T08:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">VMware Cloud Foundation</span><span style=\"background-color: rgb(255, 255, 255);\"> contains a directory traversal vulnerability. </span>A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.<span style=\"background-color: rgb(255, 255, 255);\"><br><br></span><br>"}], "value": "VMware Cloud Foundation\u00a0contains a directory traversal vulnerability.\u00a0A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-06-24T07:14:51.965Z"}, "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733"}], "source": {"discovery": "UNKNOWN"}, "title": "VMware Cloud Foundation Directory Traversal Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T13:23:11.049507Z", "id": "CVE-2025-41229", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-24T14:57:39.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41229", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-20T13:23:11.049507Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T13:23:36.341Z"}}], "cna": {"title": "VMware Cloud Foundation Directory Traversal Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "Cloud Foundation", "versions": [{"status": "affected", "version": "5.x", "lessThan": "5.2.1.2", "versionType": "custom"}, {"status": "affected", "version": "4.5.x"}], "defaultStatus": "unaffected"}], "datePublic": "2025-05-20T08:30:00.000Z", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "VMware Cloud Foundation\u00a0contains a directory traversal vulnerability.\u00a0A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">VMware Cloud Foundation</span><span style=\"background-color: rgb(255, 255, 255);\"> contains a directory traversal vulnerability. </span>A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.<span style=\"background-color: rgb(255, 255, 255);\"><br><br></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-06-24T07:14:51.965Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41229", "state": "PUBLISHED", "dateUpdated": "2025-06-24T14:57:39.945Z", "dateReserved": "2025-04-16T09:29:46.972Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2025-05-20T12:53:57.430Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}