An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the login form to inject malicious scripts which would lead to a XSS attack under certain conditions.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
| Link | Providers |
|---|---|
| https://saviynt.com/trust-compliance-security |
|
History
Mon, 21 Apr 2025 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 21 Apr 2025 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the login form to inject malicious scripts which would lead to a XSS attack under certain conditions. | |
| Title | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Saviynt
Published:
Updated: 2025-04-21T12:38:16.967Z
Reserved: 2025-04-21T09:34:01.701Z
Link: CVE-2025-3840
Vulnrichment
Updated: 2025-04-21T12:38:05.573Z
NVD
Status : Deferred
Published: 2025-04-21T10:15:15.643
Modified: 2026-04-15T00:35:42.020
Link: CVE-2025-3840
Redhat
No data.
OpenCVE Enrichment
No data.