CVE-2025-3840 Details
Description
An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the login form to inject malicious scripts which would lead to a XSS attack under certain conditions.
A cross-site scripting (XSS) vulnerability has been identified in the End of Life (EOL) OVA-based connect installer component, which is used for installations in customer networks. This component was deprecated in September 2023, with support extended until January 2024. The vulnerability arises from improper input neutralization, allowing an actor to manipulate the action parameter of the login form to inject malicious scripts, potentially leading to an XSS attack under certain conditions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 21, 2025CISA-ADP
Assessed Apr 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://saviynt.com/trust-compliance-security | Saviynt | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Saviynt |
Affected Products
| Product | Versions |
|---|---|
| Saviynt End of Life OVA based connect installer | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Saviynt |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2025 | New CVE Received | Saviynt |