CVE-2025-25231
Published: 11 August 2025
Summary
CVE-2025-25231 is a high-severity Path Traversal (CWE-22) vulnerability in Omnissa Workspace ONE (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability tracked as CVE-2025-25231. The flaw, assigned CWE-22, permits unauthorized access to sensitive information through specially crafted GET requests directed at restricted API endpoints. It carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and no required privileges or user interaction, resulting in high confidentiality impact with no integrity or availability effects.
An unauthenticated remote attacker can exploit the issue by submitting read-only requests that traverse secondary context paths, thereby retrieving data from endpoints that should otherwise remain inaccessible. The vulnerability does not enable modification of data or service disruption, limiting impact to information disclosure.
Omnissa has published advisory OMSA-2025-0004 and a security response page detailing the issue. The associated EPSS score rose from lower values to a peak of 0.1075 on 2025-12-11 before receding to the current 0.0695, indicating a temporary increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24160
Vulnerability details
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.