Saviynt End-of-Life OVA Component Remote Code Execution Vulnerability

A vulnerability allowing remote code execution has been identified in a deprecated OVA-based component of Saviynt, which is used for installation on internal customer networks. This component reached its end of life in September 2023, with support extended until January 2024. The vulnerability arises from improper input validation, which allows an actor to manipulate a request parameter and inject a payload that could be executed on the host infrastructure.

Impact

Exploitation of this vulnerability allows for remote code execution on the infrastructure hosting the affected Saviynt component.