CVE-2024-5866 - CVE House
Back to Database
Status published Medium CVE-2024-5866

Arbitrary Directory Listing in Centrify PAS

Vulnerability Description

Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary directory outside the root directory of the web application. Versions 23.1-HF7 and on have the patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5866

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • The vulnerability was discovered by Vladas Bulavas from Kaspersky

References

More from Delinea

View All →
CVE-2025-6943
Secret Server version 11.7 and earlier is vulnerable to a...
Low 3.8
CVE-2025-6942
The distributed engine versions 8.4.39.0 and earlier of Secret Server...
Low 3.8
CVE-2024-5865
Arbitrary File Reading in Centrify PAS
High 7.7
CVE-2024-52926
Delinea Privilege Manager before 12.0.2 mishandles the security of the...
Medium 6.5
CVE-2024-25652
In Delinea PAM Secret Server 11.4, it is possible for...
High 7.6

Affected Vendor

Affected Software

Centrify PAS
Vulnerable Versions:
v. 21.3

Timeline

Official Publish: July 2nd, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-26

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.