CVE-2024-25652

Published: Mar 14, 2024Modified: Jun 17, 2026

8.4

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.7 / Impact: 6.0

Source: NVD

Description

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.

Affected (1)

Products: Delinea: Secret Server

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Delinea Secret Server	Version 11.4.000000

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (5)

https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin

Source: 1443cd92-d354-46d2-9290-d812316ca43a

Broken Link

https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm

Source: 1443cd92-d354-46d2-9290-d812316ca43a

Release Notes

https://trust.delinea.com/

Source: 1443cd92-d354-46d2-9290-d812316ca43a

Vendor Advisory

https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652

Source: 1443cd92-d354-46d2-9290-d812316ca43a

Third Party Advisory

https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.