VMware Cloud Foundation Vulnerability Let Attackers Access Sensitive Data

Multiple high-severity vulnerabilities affecting VMware Cloud Foundation could allow malicious actors to access sensitive data and perform unauthorized actions.

The vulnerabilities, assigned CVE IDs CVE-2025-41229, CVE-2025-41230, and CVE-2025-41231 with CVSS base scores ranging from 7.3 to 8.2, posing significant risks to organizations using affected versions of VMware Cloud Foundation. 

Directory Traversal Vulnerability Exposes Internal Services

Broadcom reports that the most severe vulnerability (CVE-2025-41229) involves a directory traversal attack vector with a CVSS base score of 8.2. 

This vulnerability allows attackers with network access to port 443 on VMware Cloud Foundation to navigate beyond intended directories and access internal services that should be restricted. 

The attack doesn’t require user interaction, making it particularly dangerous in exposed environments.

Security researchers have identified that exploiting this vulnerability follows a pattern similar to:

This technique allows attackers to bypass path restrictions and reach sensitive components, potentially leading to unauthorized system access. 

VMware has confirmed that both versions 4.5.x and 5.x of Cloud Foundation are vulnerable, requiring immediate patching.

Information Disclosure Flaw Leaks Sensitive Data

The second vulnerability (CVE-2025-41230) involves information disclosure with a CVSS score of 7.5. 

This vulnerability allows attackers to gain access to sensitive information through a specially crafted API request to port 443. 

Potentially exposed data might include authentication credentials, configuration settings, and other sensitive system information that could facilitate further attacks.

The vulnerability can be exploited using techniques such as:

Security experts warn that this vulnerability could serve as a crucial first step in chained attacks against VMware infrastructure, providing attackers with valuable reconnaissance data.

Missing Authorization Controls Allow Unauthorized Actions

The third vulnerability (CVE-2025-41231), with a CVSS score of 7.3, stems from missing authorization controls within the VMware Cloud Foundation appliance. 

Attackers who have already gained access to the appliance can exploit this vulnerability to perform unauthorized actions and access sensitive information beyond their privilege level.

This vulnerability particularly affects the internal authorization framework. The missing authorization checks allow privilege escalation and unauthorized resource manipulation, potentially compromising the entire virtualized infrastructure.

Gustavo Bonito of NATO Cyber Security Centre (NCSC) has been credited with discovering and reporting all three vulnerabilities to VMware. 

CVEs	Affected Products	Impact	Exploit Prerequisites	CVSS 3.1 Score
CVE-2025-41229	VMware Cloud Foundation 4.5.x, 5.x	Directory traversal enabling unauthorized access to internal services	Network access to port 443 on Cloud Foundation	8.2 (High)
CVE-2025-41230	VMware Cloud Foundation 4.5.x, 5.x	Information disclosure via API endpoint exposing sensitive data	Network access to port 443 on Cloud Foundation	7.5 (High)
CVE-2025-41231	VMware Cloud Foundation 4.5.x, 5.x	Missing authorization controls allowing privilege escalation	Access to Cloud Foundation appliance	7.3 (High)

Updates Recommended

VMware has released patches to address these vulnerabilities in version 5.2.1.2 for VMware Cloud Foundation 5.x users. 

For those running version 4.5.x, patches are available through KB398008. The company strongly recommends immediate updates, as no workarounds exist for these vulnerabilities.

Security analysts emphasize that organizations should prioritize these patches, especially given the critical nature of Cloud Foundation in many enterprise virtualization environments and the high CVSS scores assigned to these vulnerabilities.

Organizations using VMware Cloud Foundation should implement a security response plan that includes immediate patching, security monitoring, and a thorough review of system logs for potential compromise indicators.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar