CVE-2024-38499 HIGH

CVE-2024-38499: Improper Privilege Management Vulnerability in CA Client Automation 14.5

Vendor Broadcom
Product CA Client Automation (ITCM)
Weakness CWE-269
Published December 17, 2024
Last update December 19, 2024
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.

Key dates

02Disclosure timeline

December 17, 2024 CVE published
December 19, 2024 Record updated