Vulnerability-Lookup

CVE-2025-3838 (GCVE-0-2025-3838)

Vulnerability from cvelistv5 – Published: 2025-04-21 09:33 – Updated: 2025-04-21 12:47

Title

Improper Authorization in the installer for the EOL OVA based connect component

Summary

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.

Severity ?

6.1 (Medium)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

Saviynt

References

URL

Tags

https://saviynt.com/trust-compliance-security

Impacted products

	Vendor	Product	Version
	Saviynt	OVA based Connect	Affected: AlmaLinux-8.x_SC2.0-Client-2.0 Affected: AlmaLinux-8.x_SC2.0-Client-3.0 Affected: CentOS-7.x_SC2.0-Client-2.0 Affected: CentOS-7.x_SC2.0-Client-3.0 Affected: RHEL-8.x_SC2.0-Client-2.0 Affected: RHEL-8.x_SC2.0-Client-3.0

Credits

Achmea Security Assessment Team (SAT)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-21T12:46:52.331775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-21T12:47:37.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "OVA based Connect",
          "platforms": [
            "Linux"
          ],
          "product": "OVA based Connect",
          "vendor": "Saviynt",
          "versions": [
            {
              "status": "affected",
              "version": "AlmaLinux-8.x_SC2.0-Client-2.0"
            },
            {
              "status": "affected",
              "version": "AlmaLinux-8.x_SC2.0-Client-3.0"
            },
            {
              "status": "affected",
              "version": "CentOS-7.x_SC2.0-Client-2.0"
            },
            {
              "status": "affected",
              "version": "CentOS-7.x_SC2.0-Client-3.0"
            },
            {
              "status": "affected",
              "version": "RHEL-8.x_SC2.0-Client-2.0"
            },
            {
              "status": "affected",
              "version": "RHEL-8.x_SC2.0-Client-3.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Achmea Security Assessment Team (SAT)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eAn Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003eUnder certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis EOL component was deprecated in September 2023 with end of support extended till January 2024.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-327",
              "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-21T09:33:33.390Z",
        "orgId": "bd8dbf88-98d9-42c6-be08-cf8e48a32093",
        "shortName": "Saviynt"
      },
      "references": [
        {
          "url": "https://saviynt.com/trust-compliance-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow this documentation \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.saviyntcloud.com/bundle/Saviynt-Connect-20-Resources/page/Content/Saviynt-Connect-20-Client-Configurations.htm\"\u003e\u003cspan style=\"background-color: transparent;\"\u003elink\u003c/span\u003e\u003c/a\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u0026nbsp;and migrate to the latest version of Saviynt Connect component\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Follow this documentation  link https://docs.saviyntcloud.com/bundle/Saviynt-Connect-20-Resources/page/Content/Saviynt-Connect-20-Client-Configurations.htm \u00a0and migrate to the latest version of Saviynt Connect component"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Authorization in the installer for the EOL OVA based connect component",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bd8dbf88-98d9-42c6-be08-cf8e48a32093",
    "assignerShortName": "Saviynt",
    "cveId": "CVE-2025-3838",
    "datePublished": "2025-04-21T09:33:33.390Z",
    "dateReserved": "2025-04-21T09:22:37.451Z",
    "dateUpdated": "2025-04-21T12:47:37.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"packageName\": \"OVA based Connect\", \"platforms\": [\"Linux\"], \"product\": \"OVA based Connect\", \"vendor\": \"Saviynt\", \"versions\": [{\"status\": \"affected\", \"version\": \"AlmaLinux-8.x_SC2.0-Client-2.0\"}, {\"status\": \"affected\", \"version\": \"AlmaLinux-8.x_SC2.0-Client-3.0\"}, {\"status\": \"affected\", \"version\": \"CentOS-7.x_SC2.0-Client-2.0\"}, {\"status\": \"affected\", \"version\": \"CentOS-7.x_SC2.0-Client-3.0\"}, {\"status\": \"affected\", \"version\": \"RHEL-8.x_SC2.0-Client-2.0\"}, {\"status\": \"affected\", \"version\": \"RHEL-8.x_SC2.0-Client-3.0\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Achmea Security Assessment Team (SAT)\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eAn Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. \u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eUnder certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. \u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eThis EOL component was deprecated in September 2023 with end of support extended till January 2024.\u003c/span\u003e\u003c/p\u003e\"}], \"value\": \"An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.\"}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"attackVector\": \"ADJACENT\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"privilegesRequired\": \"NONE\", \"providerUrgency\": \"NOT_DEFINED\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\", \"lang\": \"en\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-327\", \"description\": \"CWE-327 Use of a Broken or Risky Cryptographic Algorithm\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"bd8dbf88-98d9-42c6-be08-cf8e48a32093\", \"shortName\": \"Saviynt\", \"dateUpdated\": \"2025-04-21T09:33:33.390Z\"}, \"references\": [{\"url\": \"https://saviynt.com/trust-compliance-security\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: transparent;\\\"\u003eFollow this documentation \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.saviyntcloud.com/bundle/Saviynt-Connect-20-Resources/page/Content/Saviynt-Connect-20-Client-Configurations.htm\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003elink\u003c/span\u003e\u003c/a\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e\u0026nbsp;and migrate to the latest version of Saviynt Connect component\u003c/span\u003e\u003cbr\u003e\"}], \"value\": \"Follow this documentation  link https://docs.saviyntcloud.com/bundle/Saviynt-Connect-20-Resources/page/Content/Saviynt-Connect-20-Client-Configurations.htm \\u00a0and migrate to the latest version of Saviynt Connect component\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Improper Authorization in the installer for the EOL OVA based connect component\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3838\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-21T12:46:52.331775Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-21T12:47:00.795Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-3838\", \"assignerOrgId\": \"bd8dbf88-98d9-42c6-be08-cf8e48a32093\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Saviynt\", \"dateReserved\": \"2025-04-21T09:22:37.451Z\", \"datePublished\": \"2025-04-21T09:33:33.390Z\", \"dateUpdated\": \"2025-04-21T12:47:37.813Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-4F5W-327F-JW8G

Vulnerability from github – Published: 2025-04-21 12:30 – Updated: 2025-04-21 12:30

Details

Severity ?

6.1 (Medium)


                  
                    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-3838"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-327"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-21T10:15:15Z",
    "severity": "MODERATE"
  },
  "details": "An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.",
  "id": "GHSA-4f5w-327f-jw8g",
  "modified": "2025-04-21T12:30:24Z",
  "published": "2025-04-21T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3838"
    },
    {
      "type": "WEB",
      "url": "https://saviynt.com/trust-compliance-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

FKIE_CVE-2025-3838

Vulnerability from fkie_nvd - Published: 2025-04-21 10:15 - Updated: 2025-04-21 14:23

Severity ?

6.1 (Medium) - CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	bd8dbf88-98d9-42c6-be08-cf8e48a32093	https://saviynt.com/trust-compliance-security

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024."
    },
    {
      "lang": "es",
      "value": "Se identific\u00f3 una vulnerabilidad de autorizaci\u00f3n incorrecta en el componente de conexi\u00f3n basado en OVA al final de su vida \u00fatil, que se implementa para su instalaci\u00f3n en la red interna del cliente. En ciertas circunstancias, esto podr\u00eda permitir que un atacante obtenga acceso no autorizado a la base de datos local que contiene credenciales del instalador con hash d\u00e9bil. Este componente al final de su vida \u00fatil qued\u00f3 obsoleto en septiembre de 2023 y su fin de soporte se extendi\u00f3 hasta enero de 2024."
    }
  ],
  "id": "CVE-2025-3838",
  "lastModified": "2025-04-21T14:23:45.950",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "bd8dbf88-98d9-42c6-be08-cf8e48a32093",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-21T10:15:15.493",
  "references": [
    {
      "source": "bd8dbf88-98d9-42c6-be08-cf8e48a32093",
      "url": "https://saviynt.com/trust-compliance-security"
    }
  ],
  "sourceIdentifier": "bd8dbf88-98d9-42c6-be08-cf8e48a32093",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "bd8dbf88-98d9-42c6-be08-cf8e48a32093",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-3838 (GCVE-0-2025-3838)

GHSA-4F5W-327F-JW8G

FKIE_CVE-2025-3838

Tags

Sightings

Nomenclature