CVE-2024-25652

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25652
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin Broken Link
https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm Release Notes
https://trust.delinea.com/ Vendor Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:delinea:secret_server:11.4.000000:*:*:*:on-premises:*:*:*
History

10 Oct 2025, 16:18

Type Values Removed Values Added
References () https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin - () https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin - Broken Link
References () https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm - () https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm - Release Notes
References () https://trust.delinea.com/ - () https://trust.delinea.com/ - Vendor Advisory
CPE cpe:2.3:a:delinea:secret_server:11.4:*:*:*:*:*:*:* cpe:2.3:a:delinea:secret_server:11.4.000000:*:*:*:on-premises:*:*:*

20 May 2025, 15:16

Type Values Removed Values Added
CWE CWE-863 CWE-287
First Time Delinea
Delinea secret Server
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 7.6
CPE cpe:2.3:a:delinea:secret_server:11.4:*:*:*:*:*:*:*
References
  • () https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin -
  • () https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm -
  • () https://trust.delinea.com/ -
References () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - () https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - Third Party Advisory
Summary (en) In Delinea PAM Secret Server 11.4, it is possible for a user (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users. (en) In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.
Information

Published : 2024-03-14 03:15

Updated : 2025-10-10 16:18

NVD link : CVE-2024-25652

Mitre link : CVE-2024-25652

CVE.ORG link : CVE-2024-25652

JSON object : View

Products Affected

delinea

  • secret_server
CWE
CWE-287

Improper Authentication