CVE-2024-38499
Improper Privilege Management Vulnerability in CA Client Automation 14.5
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Improper Privilege Management Vulnerability in CA Client Automation 14.5
CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.
Reserved 2024-06-18 | Published 2024-12-17 | Updated 2024-12-19 | Assigner symantecCWE-269 Improper Privilege Management
Matthias Deeg (e-mail: matthias.deeg@syss.de, Twitter/X: @matthiasdeeg)
support.broadcom.com/...l/content/SecurityAdvisories/0/25284
Support options
