CVE-2024-33891

Katalog CVE

CVSS 8.8 · High EPSS 1,0%

Kerentanan Use of Hard-coded Cryptographic Key pada delinea secret server. Skor CVSS 3.1 8.8 (High) menurut mitre.org.

Deskripsi (NVD)

Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.

Rincian

Terbit di NVD

28 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3 advisory vendor
• https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-... exploit · advisory pihak ketiga
• https://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2024-33891.py exploit
• https://delinea.com/products/secret-server product
• https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm release notes