CVE-2024-25649 - Vulnerability Details - OpenCVE

In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue messages, and session cookies.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Delinea	Secret Server

Configuration 1 [-]

cpe:2.3:a:delinea:secret_server:11.4:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649

History

Thu, 01 May 2025 00:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Delinea Delinea secret Server
CPEs		cpe:2.3:a:delinea:secret_server:11.4:::::::*
Vendors & Products		Delinea Delinea secret Server

Tue, 27 Aug 2024 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-316
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-03-14T00:00:00

Updated: 2024-08-27T18:37:01.984Z

Reserved: 2024-02-09T00:00:00

Link: CVE-2024-25649

Vulnrichment

Updated: 2024-08-01T23:44:09.859Z

NVD

Status : Analyzed

Published: 2024-03-14T03:15:08.540

Modified: 2025-04-30T23:59:35.150

Link: CVE-2024-25649

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-25649", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-27T18:37:01.984Z", "dateReserved": "2024-02-09T00:00:00", "datePublished": "2024-03-14T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-03-14T02:15:59.546531"}, "descriptions": [{"lang": "en", "value": "In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue messages, and session cookies."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:44:09.859Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-316", "lang": "en", "description": "CWE-316 Cleartext Storage of Sensitive Information in Memory"}]}], "affected": [{"vendor": "delinea_pam", "product": "secret_server", "cpes": ["cpe:2.3:a:delinea_pam:secret_server:11.4:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "11.4", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-27T18:33:33.416842Z", "id": "CVE-2024-25649", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T18:37:01.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:44:09.859Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-25649", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-27T18:33:33.416842Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:delinea_pam:secret_server:11.4:*:*:*:*:*:*:*"], "vendor": "delinea_pam", "product": "secret_server", "versions": [{"status": "affected", "version": "11.4"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-316", "description": "CWE-316 Cleartext Storage of Sensitive Information in Memory"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T18:36:31.588Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649"}], "descriptions": [{"lang": "en", "value": "In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue messages, and session cookies."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-03-14T02:15:59.546531"}}}, "cveMetadata": {"cveId": "CVE-2024-25649", "state": "PUBLISHED", "dateUpdated": "2024-08-27T18:37:01.984Z", "dateReserved": "2024-02-09T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-03-14T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}