VMware Cloud Foundation Vulnerability Advisory: CVE-2025-41229/230/231

Critical Vulnerability Information Vulnerability Overview Announcement ID: VMSA-2025-0009 Affected Product: VMware Cloud Foundation CVE IDs: CVE-2025-41229, CVE-2025-41230, CVE-2025-41231 Severity: Important CVSSv3 Score: 7.3–8.2 Vulnerability Details 3a. Directory Traversal Vulnerability (CVE-2025-41229) Description: VMware Cloud Foundation contains a directory traversal vulnerability. Known Attack Vector: Malicious actors can exploit this vulnerability via network access on port 443 to access internal services. Remediation: Apply the updates listed in the "Fixed Version" column of the "Response Matrix". 3b. Information Disclosure Vulnerability (CVE-2025-41230) Description: VMware Cloud Foundation contains an information disclosure vulnerability. Known Attack Vector: Malicious actors can exploit this vulnerability via network access on port 443 to obtain sensitive information. Remediation: Apply the updates listed in the "Fixed Version" column of the "Response Matrix". 3c. Missing Authorization Vulnerability (CVE-2025-41231) Description: VMware Cloud Foundation contains a missing authorization vulnerability. Known Attack Vector: Malicious actors can exploit this vulnerability to perform unauthorized operations and access sensitive information. Remediation: Apply the updates listed in the "Fixed Version" column of the "Response Matrix". Affected Versions and Fixed Versions Reference Links VMware Cloud Foundation 5.2.1.2 Download and Release Notes MITRE CVE Dictionary Link FIRST CVSSv3 Calculator Contact Information Email: vmware-partner@broadcom.com PGP Key: https://kb.vmware.com/s/article/321501

Goal Reached Thanks to every supporter — we hit 100%!

VMware Cloud Foundation Vulnerability Advisory: CVE-2025-41229/230/231