TI-2025-03390 Aliases CVE-2025-3840 GHSA-rx59-94qj-gp9f

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

LOW 11CWE-79Published 2025-04-21 · Updated 2025-04-21

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the login form to inject malicious scripts which would lead to a XSS attack under certain conditions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00254 17th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Saviynt	OVA based Connect	AlmaLinux-8.x_SC2.0-Client-2.0; AlmaLinux-8.x_SC2.0-Client-3.0; CentOS-7.x_SC2.0-Client-2.0; CentOS-7.x_SC2.0-Client-3.0; RHEL-8.x_SC2.0-Client-2.0; RHEL-8.x_SC2.0-Client-3.0	—	No fix listed	CNA

OVA based Connect VendorSaviynt Affected AlmaLinux-8.x_SC2.0-Client-2.0; AlmaLinux-8.x_SC2.0-Client-3.0; CentOS-7.x_SC2.0-Client-2.0; CentOS-7.x_SC2.0-Client-3.0; RHEL-8.x_SC2.0-Client-2.0; RHEL-8.x_SC2.0-Client-3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-3840
2026-10-03 Alias added: GHSA-rx59-94qj-gp9f

References

Other 1

https://saviynt.com/trust-compliance-security

TI-2022-07858 An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. CVSS 3.1CRITICAL 9.8
TI-2025-03387 Improper Input Validation vulnerability in the End of Life (EOL) OVA based connect component CVSS 4.0MEDIUM 6.1
TI-2025-03388 Improper Authorization in the installer for the EOL OVA based connect component CVSS 4.0MEDIUM 6.1
TI-2022-07859 An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences