« Volver al listado

CVE-2025-22244

Estado: AnalizadaMedia (6.9)—

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Broadcom — Vmware NSXVmware — Cloud FoundationVmware — Telco Cloud InfrastructureVmware — Telco Cloud Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22244",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22244",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-04T20:04:14.043348Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "VMware NSX",
          "versions": [
            {
              "status": "affected",
              "version": "VMware NSX 4.0.x, VMware NSX 4.1.x, VMware NSX 4.2.x"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-04T20:15:22.263",
  "references": [
    {
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25738",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation."
    },
    {
      "lang": "es",
      "value": "VMware NSX contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el firewall de puerta de enlace debido a una validación de entrada incorrecta."
    }
  ],
  "lastModified": "2026-06-17T08:45:52.733",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:vmware_nsx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA802D68-9739-4EF6-8A2A-841E5A30B747",
              "versionEndExcluding": "4.1.2.6",
              "versionStartIncluding": "3.2"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:vmware_nsx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EA245FB-84B8-4B53-8697-029435CD793E",
              "versionEndExcluding": "4.2.1.4",
              "versionStartIncluding": "4.2.1"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:vmware_nsx:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED3E4DA6-50BF-402E-AC32-29FB702C23DA"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D2A1D50-E58C-4FB4-821E-CB17B4D6170C",
              "versionEndIncluding": "5.2.1.2",
              "versionStartIncluding": "4.5"
            },
            {
              "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "904AA81A-D1C3-4DAF-BB2C-C51FEDF5B3F6",
              "versionEndIncluding": "3.0",
              "versionStartIncluding": "2.2"
            },
            {
              "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0E78094-639D-47D6-998B-4EB111E45D18",
              "versionEndIncluding": "5.0",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}