Description
VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | VMware Aria Automation | 8.x – < 8.18.1 patch 1 | 8.18.1 patch 1 |
| VMware | VMware Cloud Foundation (VMware Aria Automation) | 5.x – < 8.18.1 patch 1, 4.x – < 8.18.1 patch 1 | 8.18.1 patch 1 |
Advisories 1
- WID-SEC-2025-0022 VMware Cloud Foundation: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jan 7, 2025