CVE-2025-25229

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Omnissa	Omnissa Workspace ONE UEM	Omnissa Workspace ONE UEM version 24.10.0.10 or earlier; Omnissa Workspace ONE UEM version 24.6.0.34 or earlier; Omnissa Workspace ONE UEM version 24.2.0.29 or earlier; Omnissa Workspace ONE UEM version 23.10.0.49 or earlier

References

Timeline

Published: Aug 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-25239.4The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CD CVE-2025-252307.8Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is in CVE-2025-252317.5Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensiti CVE-2025-252347.5Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able t CVE-2025-252358.6Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 runni CVE-2025-252365.3Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive in CVE-2025-25244.8The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2025-252415.4Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow CVE-2025-252426.1SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Script CVE-2025-252438.6SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet CVE-2025-252445.7SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attack CVE-2025-252456.1SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly se