CVE-2024-25650

MEDIUM 5.9CVE-2024-25650 · Published 14/03/2024 · updated 17/06/2026

In short

CVE-2024-25650 is a MEDIUM (CVSS 5.9) vulnerability affecting distributed engine (delinea), secret server (delinea).
Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 16.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
distributed engine delinea	`= 8.4.3`	No fix yet
secret server delinea	`= 11.4.000000`	No fix yet

Description

Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This makes it possible for a PAM administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges, without being audited in the application.

References

cvcn.gov.it/cvcn/cve/CVE-2024-25650 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free