VulnerabilityDeferred
CVE-2025-6942
The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine.
LOW 3.8EPSS 0.13%
Does this matter?
Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.
Description
The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine.
- CVSS 3.1
- 3.8 LOWCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
- EPSS
- 0.13% probability · 3th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Source
- 1443cd92-d354-46d2-9290-d812316ca43a
References
- https://docs.delinea.com/online-help/secret-server-changelog/secret-server-change-log.htm?cshid=secret-server-changelog#Friday,_November_22,_2024
- https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000060.htm
- https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000061.htm
- https://trust.delinea.com/?tcuUid=2b68edca-7930-438d-b960-2d6da07cdde9
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.