Home

Description

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.

PUBLISHED Reserved 2025-04-21 | Published 2025-04-21 | Updated 2025-04-21 | Assigner Saviynt




MEDIUM: 6.1CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-863 Incorrect Authorization

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

Product status

Default status
unaffected

AlmaLinux-8.x_SC2.0-Client-2.0
affected

AlmaLinux-8.x_SC2.0-Client-3.0
affected

CentOS-7.x_SC2.0-Client-2.0
affected

CentOS-7.x_SC2.0-Client-3.0
affected

RHEL-8.x_SC2.0-Client-2.0
affected

RHEL-8.x_SC2.0-Client-3.0
affected

Credits

Achmea Security Assessment Team (SAT) finder

References

saviynt.com/trust-compliance-security

cve.org (CVE-2025-3838)

nvd.nist.gov (CVE-2025-3838)

Download JSON