CVE-2024-25652

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-14 · updated 2026-06-17
Weakness: CWE-287

Description

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.

Affected products

Delinea Secret Server: 11.4.000000

References

https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin
https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm
https://trust.delinea.com/
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652

Get alerted when CVE-2024-25652 or the next vulnerability affects your stack