CVE-2025-3840 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the login form to inject malicious scripts which would lead to a XSS attack under certain conditions.

Reserved 2025-04-21 | Published 2025-04-21 | Updated 2025-04-21 | Assigner Saviynt

LOW: 2.1CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

AlmaLinux-8.x_SC2.0-Client-2.0

affected

AlmaLinux-8.x_SC2.0-Client-3.0

affected

CentOS-7.x_SC2.0-Client-2.0

affected

CentOS-7.x_SC2.0-Client-3.0

affected

RHEL-8.x_SC2.0-Client-2.0

affected

RHEL-8.x_SC2.0-Client-3.0

affected

Credits

Achmea Security Assessment Team (SAT) finder

References

saviynt.com/trust-compliance-security

cve.org (CVE-2025-3840)

nvd.nist.gov (CVE-2025-3840)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-3840

Support options

Helpdesk Chat, Email, Knowledgebase