« Volver al listado

CVE-2025-22216

Estado: AplazadaMedia (5.4)—

A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Cloudfoundry — UAAAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22216",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22216",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-31T17:41:49.840635Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Cloud Foundry",
          "product": "Cloud Foundry UAA",
          "versions": [
            {
              "status": "affected",
              "version": "77.20.X",
              "lessThan": "77.20.2",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "77.2X.0",
              "lessThan": "77.25.0",
              "versionType": "RELEASE"
            }
          ],
          "platforms": [
            "any"
          ],
          "packageName": "UAA",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-01-31T06:15:30.090",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2025-22216-uaa-missing-zone-validation/",
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A UAA configured with multiple identity zones, does not properly validate session information across those zones.  A User authenticated against a corporate IDP can re-use their jsessionid to access other zones."
    },
    {
      "lang": "es",
      "value": "Un UAA configurado con múltiples zonas de identidad no valida correctamente la información de la sesión en esas zonas. Un usuario autenticado con un IDP corporativo puede reutilizar su jsessionid para acceder a otras zonas."
    }
  ],
  "lastModified": "2026-06-17T08:45:39.510",
  "sourceIdentifier": "security@vmware.com"
}