CVE-2025-3837

MEDIUM

Saviynt OVA based Connect < AlmaLinux-8.x_SC2.0-Client-2.0 - Remote Code Execution via Request Parameter Manipulation

Title source: manual
STIX 2.1

Description

An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installation purposes in the customer internal network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. Under certain circumstances, an actor can manipulate a specific request parameter and inject code execution payload which could lead to a remote code execution on the infrastructure hosting this component.

References (1)

Core 1
Core References

Scores

CVSS v4 6.1
EPSS 0.0027
EPSS Percentile 18.3%
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (6)
Saviynt/OVA based Connect AlmaLinux-8.x_SC2.0-Client-2.0
Saviynt/OVA based Connect AlmaLinux-8.x_SC2.0-Client-3.0
Saviynt/OVA based Connect CentOS-7.x_SC2.0-Client-2.0
Saviynt/OVA based Connect CentOS-7.x_SC2.0-Client-3.0
Saviynt/OVA based Connect RHEL-8.x_SC2.0-Client-2.0
Saviynt/OVA based Connect RHEL-8.x_SC2.0-Client-3.0
Published Apr 21, 2025
Tracked Since Feb 18, 2026