CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-41228: VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
4.3
CVSS
Description
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
Classification
CVE ID: CVE-2025-41228
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Affected Products
Vendor: n/a
Product: VMware vCenter Server, VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure, VMware ESXi
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 7.4% (scored less or equal to compared to others)
EPSS Date: 2025-06-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-41228https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717