CVE-2025-3838 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.

Reserved 2025-04-21 | Published 2025-04-21 | Updated 2025-04-21 | Assigner Saviynt

MEDIUM: 6.1CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-863 Incorrect Authorization

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

Product status

Default status

unaffected

AlmaLinux-8.x_SC2.0-Client-2.0

affected

AlmaLinux-8.x_SC2.0-Client-3.0

affected

CentOS-7.x_SC2.0-Client-2.0

affected

CentOS-7.x_SC2.0-Client-3.0

affected

RHEL-8.x_SC2.0-Client-2.0

affected

RHEL-8.x_SC2.0-Client-3.0

affected

Credits

Achmea Security Assessment Team (SAT) finder

References

saviynt.com/trust-compliance-security

cve.org (CVE-2025-3838)

nvd.nist.gov (CVE-2025-3838)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-3838

Support options

Helpdesk Chat, Email, Knowledgebase