Broadcom has launched security updates to patch 5 security flaws impacting VMware Aria Operations and Aria Operations for Logs, warning prospects that attackers might exploit them to realize elevated entry or acquire delicate info.
The record of recognized flaws, which impression variations 8.x of the software program, is under –
- CVE-2025-22218 (CVSS rating: 8.5) – A malicious actor with View Solely Admin permissions might be able to learn the credentials of a VMware product built-in with VMware Aria Operations for Logs
- CVE-2025-22219 (CVSS rating: 6.8) – A malicious actor with non-administrative privileges might be able to inject a malicious script that will result in arbitrary operations as admin person by way of a saved cross-site scripting (XSS) assault
- CVE-2025-22220 (CVSS rating: 4.3) – A malicious actor with non-administrative privileges and community entry to Aria Operations for Logs API might be able to carry out sure operations within the context of an admin person
- CVE-2025-22221 (CVSS rating: 5.2) – A malicious actor with admin privileges to VMware Aria Operations for Logs might be able to inject a malicious script that could possibly be executed in a sufferer’s browser when performing a delete motion within the Agent Configuration
- CVE-2025-22222 (CVSS rating: 7.7) – A malicious person with non-administrative privileges could exploit this vulnerability to retrieve credentials for an outbound plugin if a sound service credential ID is thought
Safety researchers Maxime Escourbiac from Michelin CERT, and Yassine Bengana and Quentin Ebel from Abicom and a part of the Michelin CERT staff for detecting and reporting the issues. It is value noting that the identical staff noticed two different shortcomings in the identical product (CVE-2024-38832 and CVE-2024-38833) in late November 2024.
All of the aforementioned vulnerabilities have been patched in VMware Aria Operations and Aria Operations for Logs model 8.18.3. The virtualization companies supplier makes no point out of those points being exploited within the wild.
The advisory comes days after Broadcom warned of a high-severity security flaw in VMware Avi Load Balancer (CVE-2025-22217, CVSS rating: 8.6) that could possibly be weaponized by malicious actors to realize database entry.
