CVE-2024-25652 - CVE House
Back to Database
Status published High CVE-2024-25652

In Delinea PAM Secret Server 11.4, it is possible for...

Vulnerability Description

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25652

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Agenzia Per La Cybersicurezza Nazionale

References

More from Delinea

View All →
CVE-2025-6943
Secret Server version 11.7 and earlier is vulnerable to a...
Low 3.8
CVE-2025-6942
The distributed engine versions 8.4.39.0 and earlier of Secret Server...
Low 3.8
CVE-2024-5866
Arbitrary Directory Listing in Centrify PAS
Medium 5
CVE-2024-5865
Arbitrary File Reading in Centrify PAS
High 7.7
CVE-2024-52926
Delinea Privilege Manager before 12.0.2 mishandles the security of the...
Medium 6.5

Affected Vendor

Affected Software

Secret Server
Vulnerable Versions:
11.4

Timeline

Official Publish: March 14th, 2024
Last Modified: May 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access