Vulnerability · Published Jan 30, 2025 · Assigned by vmware
CVE-2025-22220VMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)
Medium 4.3
In plain English
A medium-severity privilege mismanagement in VMware Aria Operations for Logs from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VMware | VMware Aria Operations for Logs | 8.x – before 8.18.3 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N