Delinea Secret Server versions earlier than 12.3.1 are affected. Under certain conditions, a user can submit an unsigned JWT and receive cloudadmin permissions in response. This allows privilege escalation to administrative control over stored privileged credentials. The CVSS 4.0 score is 8.7 (High), and the vector requires high privileges and high attack complexity.
Delinea · Secret Server
Delinea Secret Server versions earlier than 12.3.1 allow a user to bypass the initial login step. By successfully completing only the second factor login step, an attacker can authenticate without passing the first factor. The CVSS v4.0 base score is 8.7 (High), and the CNA rates the impact on confidentiality and integrity as high.
Delinea · Secret Server
The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.
Delinea · Privilege Manager