CVE-2024-33891

HIGH EPSS 60.0%
Published Apr 28, 20242y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Apr 28, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
60.0% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-321

Affected Products 1

VendorProductVersionRange
delineasecret_server* <11.7.000001

References 5

  • delinea.com https://delinea.com/products/secret-server
    Product
  • docs.delinea.com https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm
    Release Notes
  • github.com https://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2024-33891.py
    Exploit
  • straightblast.medium.com https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3
    ExploitThird Party Advisory
  • trust.delinea.com https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.