CVE-2024-40595

Oct. 25, 2024, 12:56 p.m.

5.3
Medium

Description

An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS before 7.0.5.1) allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol information.

Product(s) Impacted

Product Versions
One Identity Safeguard for Privileged Sessions (SPS) On Premise
  • before 7.5.1
  • LTS before 7.0.5.1

Weaknesses

CWE-319
Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References

https://support.oneidentity.com/kb/4376565/cve-2024-40595-authentication-bypass-vulnerability

Tags

cve@mitre.org
CWE-319
2024-10-24
CVE-2024-40595

CVSS Score

5.3 / 10

CVSS Data

  • Attack Vector: ADJACENT_NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE
    • View Vector String

    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Date

  • Published: Oct. 24, 2024, 6:15 a.m.
  • Last Modified: Oct. 25, 2024, 12:56 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.