CVE-2025-25236

Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://static.omnissa.com/sites/default/files/OMSA-2025-0005.pdf
https://www.omnissa.com/omnissa-security-response/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Omnissa Workspace ONE UEM contiene una vulnerabilidad de discrepancia de respuesta observable. Un actor malicioso podría enumerar información sensible como el ID de inquilino y las cuentas de usuario, lo que podría facilitar ataques de fuerza bruta, pulverización de contraseñas o relleno de credenciales.

Information

Published : 2025-11-12 18:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-25236

Mitre link : CVE-2025-25236

CVE.ORG link : CVE-2025-25236

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2025-25236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-25236", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T20:47:19.871235Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52", "affectedData": [{"vendor": "Omnissa", "product": "Omnissa Workspace ONE UEM", "versions": [{"status": "affected", "version": "Omnissa Workspace ONE UEM version prior to 24.10.0.25"}, {"status": "affected", "version": "Omnissa Workspace ONE UEM version prior to 24.6.0.44"}, {"status": "affected", "version": "Omnissa Workspace ONE UEM version prior to 24.2.0.36"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-12T18:15:35.200", "references": [{"url": "https://static.omnissa.com/sites/default/files/OMSA-2025-0005.pdf", "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52"}, {"url": "https://www.omnissa.com/omnissa-security-response/", "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks."}, {"lang": "es", "value": "Omnissa Workspace ONE UEM contiene una vulnerabilidad de discrepancia de respuesta observable. Un actor malicioso podr\u00eda enumerar informaci\u00f3n sensible como el ID de inquilino y las cuentas de usuario, lo que podr\u00eda facilitar ataques de fuerza bruta, pulverizaci\u00f3n de contrase\u00f1as o relleno de credenciales."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "de5a6978-88fe-4c27-a7df-d0d5b52d5b52"}