Siteminder: Apache POI vulnerability CVE-2025-31672 in SiteMinder Admin UI

Products

• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)

Issue/Introduction

A vulnerability scan (such as Tenable/Nessus plugin TEN-234190) may flag the SiteMinder Admin UI due to the use of Apache POI libraries versions prior to 5.4.0. These libraries are susceptible to improper input validation (CVE-2025-31672), which could potentially allow remote attackers to supply a modified OOXML format file to trigger malicious behavior.

Environment

SiteMinder Admin UI 12.8.7 through 12.9

 Apache POI 5.2.2 and earlier

Cause

The SiteMinder Admin UI bundles Apache POI libraries (e.g., `poi-5.2.2.jar`, `poi-ooxml-5.2.2.jar`) for internal processing that are affected by CVE-2025-31672.

Resolution

Fixed in SiteMinder Admin UI 12.8.08 and higher. See [Download Broadcom products and software](https://support.broadcom.com/web/ecx/downloads) for steps to download the latest release.

 

For environments where an immediate upgrade is not possible, apply the following manual remediation patch:

 

1. Download the patch [36414374.zip](https://supportftp.broadcom.com/WebInterface/redirect.html?filePath=1100000169/36937438/files_from_broadcom/36414374.zip).
2. Stop the Admin UI service.
3. Navigate to the following library directory:

   `<ADMINUI_HOME>/standalone/deployments/iam_siteminder.ear/user_console.war/WEB-INF/lib`

4. Back up the following JAR files to a location outside of the installation directory and then remove them from the `lib` folder:

   * `commons-compress-1.21.jar`

   * `poi-5.2.2.jar`

   * `poi-ooxml-5.2.2.jar`

   * `poi-ooxml-lite-5.2.2.jar`

5. Copy the replacement JAR files from the downloaded zip into the `lib` directory:

   * `commons-compress-1.27.1.jar`

   * `poi-5.4.0.jar`

   * `poi-ooxml-5.4.0.jar`

   * `poi-ooxml-lite-5.4.0.jar`

6. Start the Admin UI service.

Additional Information

[CVE-2025-31672 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-31672)

For assistance with downloads, see [Contact Support](https://support.broadcom.com/web/ecx/contact-support).