What’s Vulnerable › Vulnerabilities

CVE-2024-37393

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-10 · updated 2026-06-17
• Weakness: CWE-319

Description

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.

Affected products

• SecurEnvoy Multi-Factor Authentication Solutions: before 9.4.514 — fixed in 9.4.514

How to fix

Upgrade to a fixed version: SecurEnvoy Multi-Factor Authentication Solutions 9.4.514. Check the vendor advisory for mitigations.

References

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22
• https://securenvoy.com/support/
• https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22
• https://securenvoy.com/support/
• https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393

Get alerted when CVE-2024-37393 or the next vulnerability affects your stack