Delinea addressed a reported case on Secret Server v11.7.31 (protocol...
Vulnerability Description
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfully exploited, a remote attacker may be able to convince a user to visit a malicious web-page, or open a malicious document which could trigger the vulnerable handler, allowing them to execute arbitrary code on the user's machine. Delinea added additional validation that the downloaded installer's batch file was in the expected format.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12908
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- David Cash and Richard Warren of Amber Wolf
References
More from Delinea
View All →Affected Vendor
Delinea
View all reports →