CVE-2024-25650
MEDIUMDelinea Secret Server 11.4 & Distributed Engine 8.4.3 - Cleartext Sensitive Information Transmission
Title source: llmDescription
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This makes it possible for a PAM administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges, without being audited in the application.
References (1)
Core 1
Core References
Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25650
Scores
CVSS v3
5.9
EPSS
0.0025
EPSS Percentile
16.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-319
Status
published
Products (2)
delinea/distributed_engine
8.4.3
delinea/secret_server
11.4.000000
Published
Mar 14, 2024
Tracked Since
Feb 18, 2026