CVE-2024-38499

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Dec 17, 2024
Updated: Dec 19, 2024
CWE ID 276
CWE ID 269

Summary

CVE-2024-38499 is a vulnerability affecting CA Client Automation (ITCM). This issue permits non-admin/non-root users to encrypt strings using the CAF CLI and SD_ACMD CLI. The encrypted strings may contain critical encryption keys, enabling unauthorized access to stored credentials. The vulnerability no longer allows non-admin/non-root users to execute the "caf encrypt"/"sd_acmd encrypt" commands as a mitigation measure.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share