Secret Server (On-Prem) vulnerabilities
5 known vulnerabilities in Secret Server (On-Prem) from Delinea. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
Secret Server (On-Prem): Incorrect Authorization
In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
- 9.9 Critical severity
Secret Server (On-Prem): Authentication Bypass Using an Alternate Path or Channel
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- 9.4 Critical severity
Secret Server (On-Prem): Improper Access Control
In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
- 9.1 Critical severity
Secret Server (On-Prem): Use of a Broken or Risky Cryptographic Algorithm
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
- 9.8 Critical severity
Secret Server (On-Prem): Authentication Bypass by Spoofing
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.