PT-2025-17432 · Unknown · Ova Connect Installer

Published 2025-04-21 · Updated 2025-04-21 · CVE-2025-3840

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OVA Connect Installer (affected versions not specified)

Description An improper neutralization of input issue was identified in the End of Life (EOL) OVA based connect installer component. This component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the "login form" to inject malicious scripts, which would lead to a Cross-Site Scripting (XSS) attack under certain conditions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3840

Affected Products

Ova Connect Installer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-3840 · Security Note
• https://twitter.com/CVEnew/status/1914255351672877226 · Twitter Post
• https://saviynt.com/trust-compliance-security · Note
• https://t.me/cvedetector/23435 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1914265196345905242 · Twitter Post
• https://twitter.com/cybercronai/status/1914390044288155944 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1914312910089621861 · Twitter Post
• https://t.me/cvetracker/22044 · Telegram Post
• https://t.me/cvenotify/119122 · Telegram Post
• https://twitter.com/CVETracker/status/1914408985731502149 · Twitter Post