{ "document" : { "aggregate_severity" : { "text" : "hoch" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "VMware Cloud Foundation ist eine Hybrid Cloud-Plattform für VM-Management und Container-Orchestrierung. \r\nDie Virtualisierungssoftware von VMware ermöglicht die simultane Ausführung von verschiedenen Betriebssystemen auf einem Host-System.\r\n\r\nDie Virtualisierungssoftware von VMware ermöglicht die simultane Ausführung von verschiedenen Betriebssystemen auf einem Host-System.\r\nVMware NSX ist eine Produktfamilie für Netzwerk-Virtualisierung und -Security.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein Angreifer kann mehrere Schwachstellen in VMware Cloud Foundation, VMware vSphere, VMware vCenter Server und VMware NSX ausnutzen, um Dateien zu manipulieren und gültige Benutzernamen offenzulegen, wodurch Brute-Force-Angriffe und unbefugter Zugriff ermöglicht werden könnten.", "title" : "Angriff" }, { "category" : "general", "text" : "- Sonstiges\n- UNIX\n- Windows", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2025-2155 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2155.json" }, { "category" : "self", "summary" : "WID-SEC-2025-2155 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2155" }, { "category" : "external", "summary" : "VMware Security Advisories vom 2025-09-29", "url" : "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150" } ], "source_lang" : "en-US", "title" : "VMware Cloud Foundation, vSphere, vCenter Server und NSX: Mehrere Schwachstellen", "tracking" : { "current_release_date" : "2025-09-29T22:00:00.000+00:00", "generator" : { "date" : "2025-09-30T10:36:18.400+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.4.0" } }, "id" : "WID-SEC-W-2025-2155", "initial_release_date" : "2025-09-29T22:00:00.000+00:00", "revision_history" : [ { "date" : "2025-09-29T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" } ], "status" : "final", "version" : "1" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "<9.0.1.0", "product" : { "name" : "VMware Cloud Foundation <9.0.1.0", "product_id" : "T047240" } }, { "category" : "product_version", "name" : "9.0.1.0", "product" : { "name" : "VMware Cloud Foundation 9.0.1.0", "product_id" : "T047240-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:cloud_foundation:9.0.1.0" } } }, { "category" : "product_version_range", "name" : "<5.2.2", "product" : { "name" : "VMware Cloud Foundation <5.2.2", "product_id" : "T047242" } }, { "category" : "product_version", "name" : "5.2.2", "product" : { "name" : "VMware Cloud Foundation 5.2.2", "product_id" : "T047242-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:cloud_foundation:5.2.2" } } } ], "category" : "product_name", "name" : "Cloud Foundation" }, { "branches" : [ { "category" : "product_version_range", "name" : "<4.2.3.1", "product" : { "name" : "VMware NSX <4.2.3.1", "product_id" : "T047247" } }, { "category" : "product_version", "name" : "4.2.3.1", "product" : { "name" : "VMware NSX 4.2.3.1", "product_id" : "T047247-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:nsx_data_center:4.2.3.1" } } }, { "category" : "product_version_range", "name" : "<4.2.2.2", "product" : { "name" : "VMware NSX <4.2.2.2", "product_id" : "T047248" } }, { "category" : "product_version", "name" : "4.2.2.2", "product" : { "name" : "VMware NSX 4.2.2.2", "product_id" : "T047248-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:nsx_data_center:4.2.2.2" } } }, { "category" : "product_version_range", "name" : "<4.1.2.7", "product" : { "name" : "VMware NSX <4.1.2.7", "product_id" : "T047249" } }, { "category" : "product_version", "name" : "4.1.2.7", "product" : { "name" : "VMware NSX 4.1.2.7", "product_id" : "T047249-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:nsx_data_center:4.1.2.7" } } } ], "category" : "product_name", "name" : "NSX" }, { "branches" : [ { "category" : "product_version_range", "name" : "<8.0 U3g", "product" : { "name" : "VMware vCenter Server <8.0 U3g", "product_id" : "T047244" } }, { "category" : "product_version", "name" : "8.0 U3g", "product" : { "name" : "VMware vCenter Server 8.0 U3g", "product_id" : "T047244-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:vcenter_server:8.0_u3g" } } }, { "category" : "product_version_range", "name" : "<7.0 U3w", "product" : { "name" : "VMware vCenter Server <7.0 U3w", "product_id" : "T047245" } }, { "category" : "product_version", "name" : "7.0 U3w", "product" : { "name" : "VMware vCenter Server 7.0 U3w", "product_id" : "T047245-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:vcenter_server:7.0_u3w" } } } ], "category" : "product_name", "name" : "vCenter Server" }, { "branches" : [ { "category" : "product_version_range", "name" : "Foundation <9.0.1.0", "product" : { "name" : "VMware vSphere Foundation <9.0.1.0", "product_id" : "T047241" } }, { "category" : "product_version", "name" : "Foundation 9.0.1.0", "product" : { "name" : "VMware vSphere Foundation 9.0.1.0", "product_id" : "T047241-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:vmware:vsphere:foundation___9.0.1.0" } } } ], "category" : "product_name", "name" : "vSphere" } ], "category" : "vendor", "name" : "VMware" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2025-41250", "product_status" : { "known_affected" : [ "T047240", "T047244", "T047241", "T047242", "T047245" ] }, "release_date" : "2025-09-29T22:00:00.000+00:00", "title" : "CVE-2025-41250" }, { "cve" : "CVE-2025-41251", "product_status" : { "known_affected" : [ "T047249", "T047240", "T047244", "T047241", "T047242", "T047247", "T047248", "T047245" ] }, "release_date" : "2025-09-29T22:00:00.000+00:00", "title" : "CVE-2025-41251" }, { "cve" : "CVE-2025-41252", "product_status" : { "known_affected" : [ "T047249", "T047240", "T047244", "T047241", "T047242", "T047247", "T047248", "T047245" ] }, "release_date" : "2025-09-29T22:00:00.000+00:00", "title" : "CVE-2025-41252" } ] }