Secret Server
Monthly
Authentication bypass in Delinea Secret Server before 12.3.1 lets a user skip the primary login step and authenticate by completing only the second-factor login step when two-factor authentication is configured. The vendor rates it 8.7 High; exploitation requires the attacker to be able to satisfy the second factor and is assessed as high complexity, so it is not a trivial unauthenticated bypass. No public exploit code or active-exploitation confirmation was identified in the available sources at time of analysis.
Delinea Secret Server versions earlier than 12.3.1 can return cloudadmin permissions to a user who submits an unsigned JWT under conditions not enumerated in the available sources, creating an authorization-bypass and privilege-escalation risk in a privileged access management product. The issue is network-reachable but rated high complexity and requires an existing privileged/authenticated context (CVSS PR:H), and it is remediated in 12.3.1. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied data.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
Delinea Secret Server before 12.3.1 can accept a FIDO2 authenticator's possession factor without reliably enforcing the PIN or biometric user-verification step, weakening the assurance expected from that second factor for authenticated users. The issue is a moderate-severity CWE-284 improper access-control weakness affecting deployments that use FIDO2 authentication; the assessed vector includes PR:H, so exploitation presupposes a privileged or authenticated context, or access to a registered FIDO2 device, rather than a fully unauthenticated remote bypass. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. [CVSS 6.5 MEDIUM]
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Authentication bypass in Delinea Secret Server before 12.3.1 lets a user skip the primary login step and authenticate by completing only the second-factor login step when two-factor authentication is configured. The vendor rates it 8.7 High; exploitation requires the attacker to be able to satisfy the second factor and is assessed as high complexity, so it is not a trivial unauthenticated bypass. No public exploit code or active-exploitation confirmation was identified in the available sources at time of analysis.
Delinea Secret Server versions earlier than 12.3.1 can return cloudadmin permissions to a user who submits an unsigned JWT under conditions not enumerated in the available sources, creating an authorization-bypass and privilege-escalation risk in a privileged access management product. The issue is network-reachable but rated high complexity and requires an existing privileged/authenticated context (CVSS PR:H), and it is remediated in 12.3.1. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied data.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
Delinea Secret Server before 12.3.1 can accept a FIDO2 authenticator's possession factor without reliably enforcing the PIN or biometric user-verification step, weakening the assurance expected from that second factor for authenticated users. The issue is a moderate-severity CWE-284 improper access-control weakness affecting deployments that use FIDO2 authentication; the assessed vector includes PR:H, so exploitation presupposes a privileged or authenticated context, or access to a registered FIDO2 device, rather than a fully unauthenticated remote bypass. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. [CVSS 6.5 MEDIUM]
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.