3.8
CVE-2025-6942
- EPSS 0.13%
- Veröffentlicht 02.07.2025 15:49:16
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle 1443cd92-d354-46d2-9290-d81231
- CVE-Watchlists
- Unerledigt
The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerDelinea
≫
Produkt
Secret Server
Default Statusaffected
Version <=
11.7.49
Version
0
Status
affected
Version <=
8.4.39.0
Version
0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.026 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 1443cd92-d354-46d2-9290-d812316ca43a | 3.8 | 0.3 | 3.4 |
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000060.htm
https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000061.htm
https://docs.delinea.com/online-help/secret-server-changelog/secret-server-change-log.htm?cshid=secret-server-changelog#Friday,_November_22,_2024
https://trust.delinea.com/?tcuUid=2b68edca-7930-438d-b960-2d6da07cdde9