CVE-2024-33849

The CI-Out-of-Office Manager software uses a fixed encryption key that doesn't change, making it possible for attackers to decrypt sensitive data if they obtain the encrypted information. This is a serious security flaw because the key should be unique and secret for each installation.

CVE-2024-33849 involves a hard-coded cryptographic key in CI-Out-of-Office Manager up to version 6.0.0.77, allowing an attacker with access to encrypted data to decrypt it without authorization. The vulnerability stems from use of a static, non-unique key (CWE-321) combined with inadequate secrets management (CWE-522), enabling circumvention of encryption-based protection mechanisms and potential exposure of confidential information.