{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2025-41233",
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "state": "PUBLISHED",
        "assignerShortName": "vmware",
        "dateReserved": "2025-04-16T09:29:46.972Z",
        "datePublished": "2025-06-12T21:39:53.475Z",
        "dateUpdated": "2025-06-13T14:05:40.989Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "affected",
                    "product": "Avi Load Balancer",
                    "vendor": "VMware",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "30.1.1",
                            "versionType": "ANY"
                        },
                        {
                            "status": "affected",
                            "version": "30.1.2",
                            "versionType": "ANY"
                        },
                        {
                            "status": "affected",
                            "version": "30.2.1",
                            "versionType": "ANY"
                        },
                        {
                            "status": "affected",
                            "version": "30.2.2",
                            "versionType": "ANY"
                        },
                        {
                            "status": "unaffected",
                            "version": "30.2.3"
                        },
                        {
                            "status": "affected",
                            "version": "31.1.1",
                            "versionType": "ANY"
                        },
                        {
                            "status": "unaffected",
                            "version": "30.1.2-2p3",
                            "versionType": "ANY"
                        },
                        {
                            "status": "unaffected",
                            "version": "30.2.1-2p6",
                            "versionType": "ANY"
                        },
                        {
                            "status": "unaffected",
                            "version": "30.2.2-2p5",
                            "versionType": "ANY"
                        },
                        {
                            "status": "unaffected",
                            "version": "31.1.1-2p2",
                            "versionType": "ANY"
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p><strong>Description:</strong></p><p>VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.broadcom.com/support/vmware-services/security-response\">Moderate severity range</a>&nbsp;with a maximum CVSSv3 base score of <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\">6.8</a>.<br><br><strong>Known Attack Vectors:</strong></p><p>An authenticated malicious user with network access may be able to use specially crafted SQL queries to gain database access.</p><p><strong>Resolution:</strong></p><p>To remediate CVE-2025-41233 apply the patches to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below.<br><br><strong>Workarounds:</strong></p><p>None.</p><p><strong>Additional Documentation:</strong></p><p>None.</p><p><strong>Acknowledgements:</strong></p><p>VMware would like to thank <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.linkedin.com/in/alexandru-copaceanu-b39aaa1a8/\">Alexandru Copaceanu</a>&nbsp;for reporting this issue to us.</p><p><strong>Notes:</strong></p><p>None.</p><p>&nbsp;</p><p><strong>Response Matrix:</strong></p><table><tbody><tr><td><strong>Product</strong></td><td><strong>Version</strong></td><td><strong>Running On</strong></td><td><strong>CVE</strong></td><td><strong>CVSSv4</strong></td><td><strong>Severity</strong></td><td><strong>Fixed Version</strong></td><td><strong>Workarounds</strong></td><td><strong>Additional Documents</strong></td></tr><tr><td>VMware Avi Load Balancer</td><td>30.1.1</td><td>Any</td><td>CVE-2025-41233</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\">6.8</a></td><td>Moderate</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html\">30.1.2-2p3</a></td><td>None</td><td>None</td></tr><tr><td>VMware Avi Load Balancer</td><td>30.1.2</td><td>Any</td><td>CVE-2025-41233</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\">6.8</a></td><td>Moderate</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html\">30.1.2-2p3</a></td><td>None</td><td>None</td></tr><tr><td>VMware Avi Load Balancer</td><td>30.2.1</td><td>Any</td><td>CVE-2025-41233</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\">6.8</a></td><td>Moderate</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-1.html\">30.2.1-2p6</a></td><td>None</td><td>None</td></tr><tr><td>VMware Avi Load Balancer</td><td>30.2.2</td><td>Any</td><td>CVE-2025-41233</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\">6.8</a></td><td>Moderate</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-2.html\">30.2.2-2p5</a></td><td>None</td><td>None</td></tr><tr><td>VMware Avi Load Balancer</td><td>30.2.3</td><td>Any</td><td>CVE-2025-41233</td><td>N/A</td><td>N/A</td><td>Unaffected</td><td>None</td><td>None</td></tr><tr><td>VMware Avi Load Balancer</td><td>31.1.1</td><td>Any</td><td>CVE-2025-41233</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\">6.8</a></td><td>Moderate</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/31-1/vmware-avi-load-balancer-release-notes/Release-Note-Section-20627.html\">31.1.1-2p2</a></td><td>None</td><td>None</td></tr></tbody></table><br><br>CWE-89 in the Avi Load Balancer component of VMware allows an authenticated attacker to execute blind SQL injections in versions 30.1.1, 30.1.2, 30.2.1, and 30.2.2 due to improper input validation, enabling unauthorized database access."
                        }
                    ],
                    "value": "Description:\n\nVMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the  Moderate severity range https://www.broadcom.com/support/vmware-services/security-response  with a maximum CVSSv3 base score of  6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N .\n\nKnown Attack Vectors:\n\nAn authenticated malicious user with network access may be able to use specially crafted SQL queries to gain database access.\n\nResolution:\n\nTo remediate CVE-2025-41233 apply the patches to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below.\n\nWorkarounds:\n\nNone.\n\nAdditional Documentation:\n\nNone.\n\nAcknowledgements:\n\nVMware would like to thank  Alexandru Copaceanu https://www.linkedin.com/in/alexandru-copaceanu-b39aaa1a8/  for reporting this issue to us.\n\nNotes:\n\nNone.\n\n \n\nResponse Matrix:\n\nProductVersionRunning OnCVECVSSv4SeverityFixed VersionWorkaroundsAdditional DocumentsVMware Avi Load Balancer30.1.1AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.1.2-2p3 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html NoneNoneVMware Avi Load Balancer30.1.2AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.1.2-2p3 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html NoneNoneVMware Avi Load Balancer30.2.1AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.2.1-2p6 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-1.html NoneNoneVMware Avi Load Balancer30.2.2AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.2.2-2p5 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-2.html NoneNoneVMware Avi Load Balancer30.2.3AnyCVE-2025-41233N/AN/AUnaffectedNoneNoneVMware Avi Load Balancer31.1.1AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 31.1.1-2p2 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/31-1/vmware-avi-load-balancer-release-notes/Release-Note-Section-20627.html NoneNone\n\nCWE-89 in the Avi Load Balancer component of VMware allows an authenticated attacker to execute blind SQL injections in versions 30.1.1, 30.1.2, 30.2.1, and 30.2.2 due to improper input validation, enabling unauthorized database access."
                }
            ],
            "impacts": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "Authenticated blind SQL injection may allow attackers to perform unauthorized database queries, potentially leading to data exposure or modification."
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "NONE",
                        "baseScore": 6.8,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "HIGH",
                        "scope": "CHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-89",
                            "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
                "shortName": "vmware",
                "dateUpdated": "2025-06-12T21:39:53.475Z"
            },
            "references": [
                {
                    "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25707"
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-06-13T14:05:34.365225Z",
                                "id": "CVE-2025-41233",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-06-13T14:05:40.989Z"
                }
            }
        ]
    }
}