Description
Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.
Problem types
CWE-1391: Use of Weak Credentials
Product status
9.0.* before 11.3.1
Credits
Aaron Herndon, Principal Security Consultant, and Marcus Chang, Security Consultant, both of Rapid7.
References
www.rapid7.com/...m-multiple-critical-vulnerabilities-fixed/
