2 lines
3.8 KiB
JSON
2 lines
3.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"OVA based Connect","platforms":["Linux"],"product":"OVA based Connect","vendor":"Saviynt","versions":[{"status":"affected","version":"AlmaLinux-8.x_SC2.0-Client-2.0"},{"status":"affected","version":"AlmaLinux-8.x_SC2.0-Client-3.0"},{"status":"affected","version":"CentOS-7.x_SC2.0-Client-2.0"},{"status":"affected","version":"CentOS-7.x_SC2.0-Client-3.0"},{"status":"affected","version":"RHEL-8.x_SC2.0-Client-2.0"},{"status":"affected","version":"RHEL-8.x_SC2.0-Client-3.0"}]}],"source":"bd8dbf88-98d9-42c6-be08-cf8e48a32093"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024."},{"lang":"es","value":"Se identificó una vulnerabilidad de autorización incorrecta en el componente de conexión basado en OVA al final de su vida útil, que se implementa para su instalación en la red interna del cliente. En ciertas circunstancias, esto podría permitir que un atacante obtenga acceso no autorizado a la base de datos local que contiene credenciales del instalador con hash débil. Este componente al final de su vida útil quedó obsoleto en septiembre de 2023 y su fin de soporte se extendió hasta enero de 2024."}],"id":"CVE-2025-3838","lastModified":"2026-06-17T09:20:46.690","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"bd8dbf88-98d9-42c6-be08-cf8e48a32093","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3838","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-04-21T12:46:52.331775Z","version":"2.0.3"}}]},"published":"2025-04-21T10:15:15.493","references":[{"source":"bd8dbf88-98d9-42c6-be08-cf8e48a32093","url":"https://saviynt.com/trust-compliance-security"}],"sourceIdentifier":"bd8dbf88-98d9-42c6-be08-cf8e48a32093","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"},{"lang":"en","value":"CWE-863"}],"source":"bd8dbf88-98d9-42c6-be08-cf8e48a32093","type":"Secondary"}]}
|