Vulnerability · Published May 20, 2025 · Assigned by vmware
CVE-2025-41228VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
Medium 4.3
In plain English
A medium-severity cross-site scripting in Cloud Foundation from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.9%top 40.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VMware | vCenter Server | 8.0 – before 8.0 U3e |
| VMware | Cloud Foundation | 5.x, 4.5.x |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x |
| VMware | Telco Cloud Infrastructure | 3.x,2.x |
| VMware | ESXi | 8.0 – before ESXi80U3se-246592277.0 – before ESXi70U3sv-24723868 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N