Siteminder AdminUI : Vulnerabilities reported on DOMPurify Version 3.2.4

Products

• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• SITEMINDER

Issue/Introduction

The version 3.2.4 of DOMPurify on the Siteminder AdminUI is reported vulnerable.

Environment

PRODUCT: Symantec Siteminder

COMPONENT: AdminUI

VERSION: 12.8 SP 7 and above

OS : Any

Cause

Vulnerable Version - DOMPurify Version 3.2.4 is vulnerable with below vulnerabilities,

CVE2026-0540

CVE2025-15599

CVE2025-48050

 

CVE2026- 0540 : Moderate (6.1) Cross-Site Scripting (XSS) Active Vulnerability. The SAFE_FOR_XML regular expression misses’ validation for five rawtext elements (noscript, xmp, noembed, noframes, iframe). Attackers can inject breaking tags (e.g., ) into attribute values to escape rawtext context and run malicious JavaScript. 

 

CVE2025- 15599 : Moderate (6.1) Cross-Site Scripting (XSS) Active Vulnerability. A regex flaw in SAFE_FOR_XML misses rawtext validation for  tags. Attackers can include a  string within allowed attribute values to break context and execute malicious code. 

 

CVE2025- 48050 : High Directory Traversal Active Vulnerability. The internal scripts/server.js file does not adequately validate that pathnames remain strictly inside the current working directory, risking data exposure.

 

Resolution

This attached fix delivers the DOMPurify Version: v3.4.12 

Update the 'api-doc.war' on the Siteminder AdminUI using the fixes in this KB

WINDOWS

1) Download 'DOMPurify_AdminUI_Fix.zip' from this KB and copy it to the AdminUI server.

2) Decompress 'DOMPurify_AdminUI_Fix.zip'

3) Stop the Adminui Service.

4) Back-up of the following directory:

<Siteminder_Home>\adminui\standalone\deployments\iam_siteminder.ear\api-doc.war

5)  Replace the files 'api-doc.war' with the files from 'DOMPurify_AdminUI_Fix.zip'

6) Start AdminUI Service.

LINUX

1) Download 'DOMPurify_AdminUI_Fix.tar.gz' from this KB and copy it to the AdminUI server.

2) Decompress 'DOMPurify_AdminUI_Fix.tar.gz'

3) Stop the Adminui Service.

4) Back-up of the following directory:

<Siteminder_Home>/adminui/standalone/deployments/iam_siteminder.ear/api-doc.war

5)  Replace the files 'api-doc.war' with the files from 'DOMPurify_AdminUI_Fix.tar.gz'

6) Start AdminUI Service.