CVE-2024-25649 Information disclosure in n/a
An administrator with local access can extract sensitive keys and credentials from memory dumps in Delinea PAM Secret Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25649?
CVE-2024-25649 is a medium-severity vulnerability in n/a, published on 14 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue messages, and session cookies.
Weakness: CWE-316
Which versions are affected by CVE-2024-25649?
It affects 1 product.
Products include Delinea Secret Server.
How do I fix CVE-2024-25649?
No fix has been published for CVE-2024-25649 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-25649 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25649 exists.
Other vulnerabilities in n/a
- CVE-2023-4589 Insufficient verification of data authenticity vulnerability in Delinea Secret Server
- CVE-2024-33891 Hardcoded credentials in n/a
- CVE-2024-25652 Missing authorization in Secret Server
- CVE-2024-12908 Code injection in Secret Server
- CVE-2023-4588 File accessibility vulnerability in Delinea Secret Server
Sources
Also known as GHSA-wxwf-h485-h4x8.