CVE-2025-22244

Published: Jun 4, 2025Modified: Jun 17, 2026

6.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

Exploitability: 1.7 / Impact: 4.7

Source: security@vmware.com (Secondary)

Description

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.

Affected (6)

Products: Broadcom: Vmware Nsx · Vmware: Cloud Foundation, Telco Cloud Infrastructure, Telco Cloud Platform

1 product

3 products

Cloud Foundation

Telco Cloud Infrastructure

Telco Cloud Platform

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Broadcom Vmware Nsx	3.2 ≤ version < 4.1.2.6
Broadcom Vmware Nsx	4.2.1 ≤ version < 4.2.1.4
Broadcom Vmware Nsx	Version 4.2.2
Vmware Cloud Foundation	4.5 ≤ version ≤ 5.2.1.2
Vmware Telco Cloud Infrastructure	2.2 ≤ version ≤ 3.0
Vmware Telco Cloud Platform	3.0 ≤ version ≤ 5.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25738

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.