CVE-2024-25650

MEDIUM Year: 2024
CVSS v3 Score
5.9
Medium
Weakness Type
CWE-319
View all →

Vulnerability Description

Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This makes it possible for a PAM administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges, without being audited in the application.

Related Vulnerabilities

CVE-2017-1232

MEDIUM
CVSS:5.9(Medium)

IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. IBM X-Fo...

CWE-3192017

CVE-2017-15042

MEDIUM
CVSS:5.9(Medium)

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. Th...

CWE-3192017

CVE-2017-2412

MEDIUM
CVSS:5.9(Medium)

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle attackers to modify the client-server data ...

CWE-3192017

CVE-2017-6341

MEDIUM
CVSS:5.9(Medium)

Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to r...

CWE-3192017

CVE-2017-8444

MEDIUM
CVSS:5.9(Medium)

The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle (MITM) the traffic between the client...

CWE-3192017

CVE-2017-8850

MEDIUM
CVSS:5.9(Medium)

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers ca...

CWE-3192017