CVE-2024-25652

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25652
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin
https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm
https://trust.delinea.com/
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:delinea:secret_server:11.4:*:*:*:*:*:*:*
History

20 May 2025, 15:16

Type Values Removed Values Added
CWE CWE-863

09 May 2025, 21:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 7.6
CWE CWE-287
Summary (en) In Delinea PAM Secret Server 11.4, it is possible for a user (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users. (en) In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.
References
  • () https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin -
  • () https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm -
  • () https://trust.delinea.com/ -
References () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - Third Party Advisory () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - Third Party Advisory

30 Apr 2025, 23:59

Type Values Removed Values Added
References () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - Third Party Advisory
First Time Delinea secret Server
Delinea
CPE cpe:2.3:a:delinea:secret_server:11.4:*:*:*:*:*:*:*

21 Nov 2024, 09:01

Type Values Removed Values Added
References () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 -

01 Aug 2024, 13:47

Type Values Removed Values Added
CWE CWE-863
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

14 Mar 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-14 03:15

Updated : 2025-05-20 15:16

NVD link : CVE-2024-25652

Mitre link : CVE-2024-25652

CVE.ORG link : CVE-2024-25652

JSON object : View

Products Affected

delinea

  • secret_server
CWE
CWE-287

Improper Authentication