VMware Tanzu Spring Framework: Schwachstelle ermöglicht Offenlegung von Informationen
WID-SEC-2025-1832 · first 14.08.2025 · updated 24.03.2026 · CVSS 5,9
What it is about
Das Spring Framework bietet ein Entwicklungsmodell für Java mit Infrastrukturunterstützung auf Anwendungsebene. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um Informationen offenzulegen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Informationen offenzulegen
Am I affected?
Affected according to the BSI:
- IBM Operational Decision Manager
- NetApp ActiveIQ Unified Manager for Linux
- NetApp ActiveIQ Unified Manager for Microsoft Windows
- IBM Business Automation Workflow
- IBM Sterling Connect:Direct
- VMware Tanzu Spring Framework <6.2.10
- Open Source Camunda <7.23.5
- Open Source Camunda <7.22.8
- Open Source Camunda <7.21.13
- RealObjects PDFreactor <12.3
- SAS Institute Base SAS <9.4M9 (TS1M9)
- HCL Commerce <25.09.17.0
and 2 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- VMware Tanzu Spring Framework 6.2.10
- Open Source Camunda 7.23.5
- Open Source Camunda 7.22.8
- Open Source Camunda 7.21.13
- RealObjects PDFreactor 12.3
- SAS Institute Base SAS 9.4M9 (TS1M9)
- HCL Commerce 25.09.17.0
- Dell Secure Connect Gateway Appliance 5.32.00.18
- Dell Secure Connect Gateway 5.34.00.16
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Spring Framework 6.2.10 release vom 2025-08-13 spring.io
- Spring Security Advisory vom 2025-08-13 spring.io
- Camunda Security Notices docs.camunda.org
- PDFreactor Release Notes vom 2025-09-05 www.pdfreactor.com
- NetApp Security Advisory NTAP-20250912-0002 vom 2025-09-12 security.netapp.com
- SAS Security Update vom 2025-10-02 support.sas.com
- IBM Security Bulletin 7247286 vom 2025-10-07 www.ibm.com
- HCL Security Bulletin vom 2025-10-15 support.hcl-software.com
- Dell Security Advisory DSA-2025-390 vom 2025-11-05 www.dell.com
- IBM Security Bulletin 7250260 vom 2025-11-06 www.ibm.com
- IBM Security Bulletin 7258317 vom 2026-01-29 www.ibm.com
- Dell Security Advisory DSA-2026-152 vom 2026-03-23 www.dell.com
CVE: CVE-2025-41242
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.