Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-22218 is a high-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Vmware Aria Operations For Logs. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Software (T1592.002); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-11 (Error Handling) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-22218 is an information disclosure vulnerability (CWE-209) in VMware Aria Operations for Logs. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs. The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and was published on 2025-01-30.
Attackers require View Only Admin permissions (low privilege requirement) to exploit this issue remotely over the network, though it demands high attack complexity and no user interaction. Successful exploitation allows disclosure of sensitive credentials from integrated VMware products, with cross-scope impact that could enable broader compromise given the high confidentiality, integrity, and availability effects rated in the CVSS vector.
Security practitioners should consult the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329 for details on patches, workarounds, and mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2674
Vulnerability Data
VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V16.5.1
Mitigating Controls (NIST 800-53 r5) AI
si-11 directly requires error messages to avoid revealing exploitable information about the system or its data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require sanitized error handling to prevent sensitive data disclosure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly forbid exposing sensitive data in errors.
Security testing can detect error messages that leak sensitive information.
Logging policy can require suppression of sensitive data in error messages.
Secure SDLC mandates error-handling rules that avoid leaking sensitive information.
Application security requirements can specify safe error messaging.
Secure architecture principles include proper exception handling.