Read the docs
TI-2025-24297 Aliases CVE-2025-34141GHSA-wffg-jjj6-c47h

ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`

Priority LOW 27CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02089 81st percentileScored 2026-11-07
Fix Fixed Reliance CG (legacy) (ETQ): SE.2025.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ETQReliance CG (legacy)before SE.2025.1SE.2025.1Patch availableCNA
  • Reliance CG (legacy) VendorETQ Affected before SE.2025.1 Fixed in SE.2025.1 Patch available CNA

Remediation

  • Fix · CNA Reliance CG (legacy) (ETQ) Fixed in SE.2025.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ETQ Reliance CG (legacy) — etq.com/blog/etq-reliance-security-update

    4 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-24299 ETQ Reliance CG Authentication Bypass via Trailing Space RCEPriority HIGH 75
    • TI-2025-24296 ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI SuffixPriority MEDIUM 45
    • TI-2025-24298 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML HandlerPriority LOW 38
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34141
  2. 2026-10-03 Alias added: GHSA-wffg-jjj6-c47h

References

Patch 1

Other 2

  • TI-2025-24299 ETQ Reliance CG Authentication Bypass via Trailing Space RCE CVSS 4.0CRITICAL 9.3
  • TI-2025-24296 ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix CVSS 4.0HIGH 8.7
  • TI-2025-24298 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences