Description
Omnissa Workspace ONE UEM 存在一个二次上下文路径穿越漏洞，攻击者可通过构造恶意 GET 请求读取受限 API 端点中的敏感信息。
Omnissa Workspace ONE UEM /DevicesGateway/apps/system-app-metadata 目录遍历漏洞（CVE-2025-25231）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-25231
https://kb.omnissa.com/s/article/6001021
https://static.omnissa.com/sites/default/files/OMSA-2025-0004.pdf
https://www.picussecurity.com/resource/blog/omnissa-workspace-one-cve-2025-25231-path-traversal-exploit
https://slcyber.io/research-center/secondary-context-path-traversal-in-omnissa-workspace-one-uem/
https://www.omnissa.com/omsa-2025-0004/
https://github.com/advisories/GHSA-6489-j79m-95x8
https://www.sentinelone.com/vulnerability-database/cve-2025-25231/
https://devhub.checkmarx.com/cve-details/cve-2025-25231/
https://cloud.tencent.com/developer/article/2579659