CVE-2024-45744 TopQuadrant TopBraid EDG password manager stores external credentials insecurely
Authenticated attackers with file system access can read configuration files to decrypt and steal external credentials stored by TopBraid EDG.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45744?
CVE-2024-45744 is a low-severity vulnerability in TopQuadrant TopBraid EDG, published on 27 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.
Which versions are affected by CVE-2024-45744?
It affects 1 product.
Products include Topquadrant Topbraid Edg.
How do I fix CVE-2024-45744?
No fix has been published for CVE-2024-45744 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45744 being exploited?
There is no known exploitation of CVE-2024-45744 in the wild and no public exploit code.
Other vulnerabilities in TopQuadrant TopBraid EDG
Sources
Also known as GHSA-8xf3-x93c-2ch6.