CVE-2025-41228

VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability

En bref

Sévérité: MEDIUM 4.3
EPSS: EPSS 0.90 % · centile 59 (2026-10-27)
État: PUBLISHED
Publiée: 2025-05-20
Mise à jour: 2025-06-24
Attribuée par: vmware
Statut NVD: Deferred

Description

VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	vmware
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	NVD · security@vmware.com (Secondary)

Faiblesses (CWE)

CWE-79

Références européennes

ENISA EUVD · EUVD-2025-15830
GCVE · GCVE-0-2025-41228

Avis du CERT-FR

CERTFR-2025-AVI-0430 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
VMware · vCenter Server	affected 8.0 < 8.0 U3e
VMware · Cloud Foundation	affected 5.x, 4.5.x
VMware · Telco Cloud Platform	affected 5.x, 4.x, 3.x, 2.x
VMware · Telco Cloud Infrastructure	affected 3.x,2.x
VMware · ESXi	affected 8.0 < ESXi80U3se-24659227 ; affected 7.0 < ESXi70U3sv-24723868

Références

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD