Unrated severityNVD Advisory· Published Apr 28, 2024· Updated Feb 12, 2025

CVE-2024-33891

Description

Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Delinea/Secret Server On-Premcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <11.7.000001

Patches

Vulnerability mechanics

References

delinea.com/products/secret-servermitre
docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htmmitre
straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3mitre
trust.delinea.commitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000