CVE-2025-22216

Published: Jan 31, 2025Modified: Jun 17, 2026Deferred

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: security@vmware.com (Secondary)

Description

A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones.

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (1)

https://www.cloudfoundry.org/blog/cve-2025-22216-uaa-missing-zone-validation/

Source: security@vmware.com

Timeline

No history available yet.