fkie_nvd - fkie_cve-2025-25229

fkie_cve-2025-25229

Vulnerability from fkie_nvd

Published

2025-08-11 19:15

Modified

2025-08-12 14:25

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.

References

	URL	Tags
	de5a6978-88fe-4c27-a7df-d0d5b52d5b52	https://www.omnissa.com/omnissa-security-response/
	de5a6978-88fe-4c27-a7df-d0d5b52d5b52	https://www.omnissa.com/omsa-2025-0004/

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability.\u00a0A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources."
    },
    {
      "lang": "es",
      "value": "Omnissa Workspace ONE UEM contiene una vulnerabilidad de Server-Side Request Forgery (SSRF). Un atacante con privilegios de usuario podr\u00eda acceder a informaci\u00f3n interna restringida del sistema, lo que podr\u00eda permitir la enumeraci\u00f3n de recursos internos de la red."
    }
  ],
  "id": "CVE-2025-25229",
  "lastModified": "2025-08-12T14:25:33.177",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-11T19:15:26.550",
  "references": [
    {
      "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52",
      "url": "https://www.omnissa.com/omnissa-security-response/"
    },
    {
      "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52",
      "url": "https://www.omnissa.com/omsa-2025-0004/"
    }
  ],
  "sourceIdentifier": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2025-25229 (GCVE-0-2025-25229)

Vulnerability from cvelistv5

Published

2025-08-11 18:24

Modified

2025-08-11 18:41

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.

References

URL

Tags

	https://www.omnissa.com/omsa-2025-0004/
	https://www.omnissa.com/omnissa-security-response/

Impacted products

	Vendor	Product	Version
	Omnissa	Omnissa Workspace ONE UEM	Version: Omnissa Workspace ONE UEM version 24.10.0.10 or earlier Version: Omnissa Workspace ONE UEM version 24.6.0.34 or earlier Version: Omnissa Workspace ONE UEM version 24.2.0.29 or earlier Version: Omnissa Workspace ONE UEM version 23.10.0.49 or earlier

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T18:40:49.393943Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T18:41:08.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Omnissa Workspace ONE UEM",
          "vendor": "Omnissa",
          "versions": [
            {
              "status": "affected",
              "version": "Omnissa Workspace ONE UEM version 24.10.0.10 or earlier"
            },
            {
              "status": "affected",
              "version": "Omnissa Workspace ONE UEM version 24.6.0.34 or earlier"
            },
            {
              "status": "affected",
              "version": "Omnissa Workspace ONE UEM version 24.2.0.29 or earlier"
            },
            {
              "status": "affected",
              "version": "Omnissa Workspace ONE UEM version 23.10.0.49 or earlier"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Omnissa would like to thank Khristopher Tolbert of Maveris for reporting this issue to us."
        }
      ],
      "datePublic": "2025-08-11T18:23:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability.\u0026nbsp;A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources."
            }
          ],
          "value": "Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability.\u00a0A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-11T18:24:17.625Z",
        "orgId": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52",
        "shortName": "Omnissa"
      },
      "references": [
        {
          "url": "https://www.omnissa.com/omsa-2025-0004/"
        },
        {
          "url": "https://www.omnissa.com/omnissa-security-response/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52",
    "assignerShortName": "Omnissa",
    "cveId": "CVE-2025-25229",
    "datePublished": "2025-08-11T18:24:17.625Z",
    "dateReserved": "2025-02-04T20:59:07.333Z",
    "dateUpdated": "2025-08-11T18:41:08.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.