CVE-2025-22218: VMware Aria Operations for Logs Info Leak

CVE-2025-22218 Overview

CVE-2025-22218 is an information disclosure vulnerability in VMware Aria Operations for Logs. A user with View Only Admin permissions can read credentials of VMware products integrated with Aria Operations for Logs. The flaw maps to [CWE-209] (Generation of Error Message Containing Sensitive Information) and affects deployments shipped with VMware Cloud Foundation.

Broadcom assigned a CVSS 3.1 base score of 7.7, reflecting network-accessible exploitation with low privileges and a confidentiality impact that crosses a security scope. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact

Authenticated low-privilege operators can harvest credentials for integrated VMware products, enabling lateral movement into vCenter, ESXi, NSX, and other connected components.

Affected Products

• VMware Aria Operations for Logs
• VMware Cloud Foundation (bundled Aria Operations for Logs component)
• Deployments granting View Only Admin role permissions

Discovery Timeline

• 2025-01-30 - CVE-2025-22218 published to the National Vulnerability Database
• 2025-01-30 - Broadcom publishes Security Advisory #25329
• 2025-05-14 - Last updated in NVD database

Technical Details for CVE-2025-22218

Vulnerability Analysis

The vulnerability resides in the integration management surface of VMware Aria Operations for Logs. Aria Operations for Logs stores credentials for connected VMware products, including vCenter Server, NSX, and other Aria suite components, to ingest logs and event telemetry. These stored credentials should remain opaque to operators who lack administrative write privileges.

The flaw allows accounts holding the View Only Admin role to retrieve those stored credentials through interfaces intended only for inspection. The CWE-209 classification indicates the credentials surface through responses or error pathways that include sensitive data not filtered for the requesting role.

The attack is network-reachable and requires authentication, so exploitation depends on an attacker first compromising or being granted a low-privilege operator account. Once disclosed, the integrated product credentials can be reused to access vCenter or other tightly-coupled VMware services, expanding the blast radius beyond the logging platform itself.

Root Cause

The root cause is insufficient authorization checks on credential retrieval paths for integration objects. Role-based access controls correctly restrict configuration changes but fail to redact or block access to credential material for View Only Admin sessions, exposing plaintext or recoverable secrets.

Attack Vector

An authenticated attacker with View Only Admin permissions queries the Aria Operations for Logs management API or UI to enumerate configured product integrations. The platform returns credential fields that should be masked, enabling the attacker to copy those secrets and authenticate against the integrated VMware product directly. No user interaction from an administrator is required.

No verified exploit code is publicly available. Refer to the Broadcom Security Advisory #25329 for vendor-supplied technical details.

Detection Methods for CVE-2025-22218

Indicators of Compromise

• Authentication events on integrated VMware products (vCenter, NSX) from source IPs or service accounts that previously only interacted with Aria Operations for Logs
• Unexpected use of integration service account credentials outside scheduled log collection windows
• API calls from View Only Admin accounts targeting integration configuration endpoints in Aria Operations for Logs

Detection Strategies

• Audit role assignments in Aria Operations for Logs and flag any account holding View Only Admin that does not require ongoing access
• Correlate Aria Operations for Logs access logs with downstream authentications on integrated products to identify credential reuse
• Alert on integration-account logins originating from interactive sessions rather than the Aria collector subnet

Monitoring Recommendations

• Forward Aria Operations for Logs audit events and vCenter authentication logs into a centralized SIEM for cross-product correlation
• Establish a baseline of legitimate API consumers for integration endpoints and alert on deviations
• Monitor service account password ages and force rotation following any suspected disclosure event

How to Mitigate CVE-2025-22218

Immediate Actions Required

• Apply the fixed versions referenced in Broadcom Security Advisory #25329 on every Aria Operations for Logs node
• Review all accounts assigned the View Only Admin role and revoke unnecessary grants
• Rotate credentials for every VMware product integrated with Aria Operations for Logs, assuming prior disclosure

Patch Information

Broadcom released fixed builds for VMware Aria Operations for Logs and asynchronous updates for VMware Cloud Foundation deployments. Customers should consult Broadcom Security Advisory #25329 for the exact fixed versions corresponding to their deployment topology and apply them through the standard Aria or VCF upgrade workflow.

Workarounds

• No vendor-supplied workaround is published; patching is the supported remediation path
• As a compensating control, restrict the View Only Admin role to trusted personnel only and remove the role from shared or service accounts
• Use dedicated, least-privilege service accounts for each product integration so that disclosed credentials grant minimal downstream access

# Configuration example: enumerate users holding View Only Admin in Aria Operations for Logs
# (executed by an administrator via the Aria API)
curl -k -H "Authorization: Bearer $TOKEN" \
  https://<aria-logs-host>/api/v2/users?role=VIEW_ONLY_ADMIN