CVE-2024-25651 Information disclosure in n/a
Remote attackers can enumerate valid users via response differences in the Authentication REST API of Delinea PAM Secret Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25651?
CVE-2024-25651 is a medium-severity vulnerability in n/a, published on 14 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.
Weakness: CWE-203
Which versions are affected by CVE-2024-25651?
It affects 1 product.
Products include Delinea Secret Server.
How do I fix CVE-2024-25651?
No fix has been published for CVE-2024-25651 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-25651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25651 exists.
Other vulnerabilities in n/a
- CVE-2023-4589 Insufficient verification of data authenticity vulnerability in Delinea Secret Server
- CVE-2024-33891 Hardcoded credentials in n/a
- CVE-2024-25652 Missing authorization in Secret Server
- CVE-2024-12908 Code injection in Secret Server
- CVE-2023-4588 File accessibility vulnerability in Delinea Secret Server
Sources
Also known as GHSA-vj7g-5fj3-rc83.