{"id":"CVE-2025-25231","aliases":["EUVD-2025-24160","GHSA-6489-j79m-95x8"],"status":"published","title":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious...","description":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.25147,"percentile":0.97957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2025-08-11T18:12:49Z","modified":"2026-06-17T09:00:32Z","exploitation":[{"source":"euvd","since":"2025-09-09"}],"exploits":[{"source":"pocgithub","id":"ashkan-pu/CVE-CVE-2025-25231","title":"ashkan-pu/CVE-CVE-2025-25231","date":"2025-08-12","url":"https://github.com/ashkan-pu/CVE-CVE-2025-25231"},{"source":"nuclei","id":"CVE-2025-25231","title":"Omnissa Workspace ONE UEM - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25231.yaml"}],"products":[{"vendor":"omnissa","product":"omnissa workspace one uem"}],"references":[{"url":"https://static.omnissa.com/sites/default/files/OMSA-2025-0004.pdf"},{"url":"https://www.omnissa.com/omnissa-security-response/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25231"},{"url":"https://www.omnissa.com/omnissa-security-response"},{"url":"https://github.com/advisories/GHSA-6489-j79m-95x8"}],"sources":{"cve":[{"id":"CVE-2025-25231","description":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.","status":"published","published":"2025-08-11T18:12:49.711Z","modified":"2025-08-11T18:26:45.876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-24160","description":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.","status":"published","published":"2025-08-11T18:12:49Z","modified":"2025-08-11T18:26:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"exploited_since":"2025-09-09","updated_at":"2026-11-02T20:31:59.900029Z"}],"ghsa":[{"id":"GHSA-6489-j79m-95x8","title":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious...","description":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.","status":"published","published":"2025-08-11T18:31:09Z","modified":"2025-08-11T21:31:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:03:14.349614Z"}],"nvd":[{"id":"CVE-2025-25231","description":"Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.","status":"published","published":"2025-08-11T18:15:32.93Z","modified":"2026-06-17T09:00:32.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:22.953396Z"}]}}