CVE-2025-22222
Published: 30 January 2025
Summary
CVE-2025-22222 is a high-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Vmware Aria Operations. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked in the top 28.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-22222 is an information disclosure vulnerability in VMware Aria Operations. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known. The issue is rated with a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and maps to CWE-497.
The vulnerability can be exploited by a malicious user possessing non-administrative privileges and network access to the affected system. Exploitation requires low complexity, no user interaction, and knowledge of a valid service credential ID. Successful attacks enable retrieval of sensitive credentials for outbound plugins, resulting in high confidentiality impact within a scoped environment.
Mitigation details are available in the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2678
Vulnerability details
VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables unauthorized retrieval of stored service credentials via known ID, facilitating Unsecured Credentials access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations to prevent non-administrative users from accessing and retrieving sensitive outbound plugin credentials.
Applies least privilege to ensure non-administrative users lack the access rights needed to retrieve service credentials even if a valid ID is known.
Monitors for inappropriate or unauthorized disclosures of sensitive credential information, enabling detection of exploitation attempts.