CVE-2024-45744: falha de baixa gravidade em TopQuadrant TopBraid EDG
TopQuadrant TopBraid EDG password manager stores external credentials insecurely
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3epss 0.2%
TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
TopQuadrant · TopBraid EDGCVEs relacionadas — TopQuadrant TopBraid EDG
No mesmo produto, das mais perigosas para as menos.
Referências
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.jsonhttps://www.topquadrant.com/doc/latest/administrator_guide/edg_installation_and_authentication/hashicorp_integration.htmlhttps://www.topquadrant.com/doc/latest/reference/PasswordManagementAdminPage.htmlhttps://www.topquadrant.com/release-note/7-3/https://www.topquadrant.com/wp-content/uploads/2025/02/changes-8.3.0.txt