HIGH🇵🇱 Wersja polska

CVE-2024-33891

CVSS 8.8v3.1pub. 2024-04-28upd. 2025-10-28

Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Delinea Secret Server

    APP
    Delinea
    < 11.7.000001
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2023-4589CRITICAL9.1ten sam produkt

Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 ver...

CVE-2024-25652HIGH7.6ten sam produkt

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or w...

CVE-2025-12810MEDIUM5.3ten sam produkt

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).Th...

CVE-2024-12908MEDIUM6.9ten sam produkt

Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within ...

CVE-2024-25653MEDIUM4.3ten sam produkt

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users,...