« Volver al listado

CVE-2025-22227

Estado: AplazadaMedia (6.1)—

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vmware — Reactor NettyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22227",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22227",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-16T14:29:51.229735Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "Reactor Netty",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.x",
              "lessThan": "1.0.49 (Reactor BOM 2020.0.48)",
              "versionType": "commercial"
            },
            {
              "status": "affected",
              "version": "1.1.x",
              "lessThan": "1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20)",
              "versionType": "commercial"
            },
            {
              "status": "affected",
              "version": "1.2.x",
              "lessThan": "1.2.8 (Reactor BOM 2024.0.8)",
              "versionType": "OSS"
            },
            {
              "status": "affected",
              "version": "1.3.x",
              "lessThan": "1.3.0-M5 (Reactor BOM 2025.0.0-M5)",
              "versionType": "OSS"
            }
          ],
          "packageName": "Reactor Netty",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-16T10:15:27.787",
  "references": [
    {
      "url": "https://spring.io/security/cve-2025-22227",
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects."
    },
    {
      "lang": "es",
      "value": "En algunos escenarios específicos con redirecciones encadenadas, el cliente HTTP de Reactor Netty filtra credenciales. Para que esto ocurra, el cliente HTTP debe estar configurado explícitamente para seguir las redirecciones."
    }
  ],
  "lastModified": "2026-06-17T08:45:45.027",
  "sourceIdentifier": "security@vmware.com"
}