Published: 21/04/2025 Updated: 21/04/2025

Cross-Site Scripting (XSS) Vulnerability in End of Life OVA Connect Installer

An End of Life (EOL) OVA based connect installer component, used for network installation, has a vulnerability involving improper neutralization of input. This deprecated component, which was phased out in September 2023 with support ending in January 2024, allows an actor to manipulate the login form's action parameter. By injecting malicious scripts through this parameter, an attacker could potentially execute a Cross Site Scripting (XSS) attack under specific conditions.

Follow this documentation link https://docs.saviyntcloud.com/bundle/Saviynt-Connect-20-Resources/page/Content/Saviynt-Connect-20-Client-Configurations.htm and migrate to the latest version of Saviynt Connect component

Vulnerable Product	Search on Vulmon	Subscribe to Product
saviynt ova based connect

CWE-79 https://nvd.nist.gov https://www.first.org/epss https://saviynt.com/trust-compliance-security

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2025-3840

Vulnerability Summary

Solution

Vulnerability Trend

References

Vulmon Search

About

Products

Connect