CVE-2025-41231 — Missing Authorization in Vmware Cloud Foundation

CWE-862 — Missing Authorization3 documents3 sources
Severity
7.3HIGHNVD
EPSS
0.1%
top 69.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Vmware Cloud FoundationVmware Cloud Foundation
Timeline
PublishedMay 20

Description

VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LExploitability: 2.5 | Impact: 4.7

Affected Packages2 packages

▶NVDvmware/cloud_foundation4.5 — 4.5.2+1
▶CVEListV5vmware/vmware_cloud_foundation5.x — 5.2.1.2+1

🔴Vulnerability Details

2
CVEList
VMware Cloud Foundation Missing Authorisation Vulnerability↗2025-05-20
▶
GHSA
GHSA-6pf2-52g7-p22m: VMware Cloud Foundation contains a missing authorisation vulnerability↗2025-05-20
▶
CVE-2025-41231 — Missing Authorization in Vmware | cvebase