CVE-2024-25652 | THREATINT

Description

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.

Reserved 2024-02-09 | Published 2024-03-14 | Updated 2025-05-09 | Assigner mitre

HIGH: 7.6CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Problem types

CWE-287 Improper Authentication

Product status

Default status

unaffected

11.4

affected

Credits

Agenzia Per La Cybersicurezza Nazionale finder

References

www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 third-party-advisory

docs.delinea.com/...rver/release-notes/ssc-rn-2024-02-10.htm release-notes

trust.delinea.com/ vendor-advisory

docs.delinea.com/...de/index.htm?Highlight=unlimited%20admin product related

cve.org (CVE-2024-25652)

nvd.nist.gov (CVE-2024-25652)

Download JSON