CVE-2025-41231

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	VMware Cloud Foundation	>= 5.x, < 5.2.1.2; 4.5.x

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733Vendor Advisory

Timeline

Published: May 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-412329.1Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Yo CVE-2025-412336.8Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the CVE-2025-412346.5Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file dow CVE-2025-412358.6Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.CVE-2025-412369.3VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor wit CVE-2025-412379.3VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-CVE-2025-412389.3VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an CVE-2025-412397.1VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised mem CVE-2025-41249.8Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitra CVE-2025-4124010.0Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server d CVE-2025-412414.4VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perf CVE-2025-412425.9Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.