Vulnerability · Published Dec 17, 2024 · Assigned by symantec

CVE-2024-38499Improper Privilege Management Vulnerability in CA Client Automation 14.5

High 8.8

In plain English

A high-severity privilege mismanagement in CA Client Automation (ITCM) from Broadcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.

Affected products (as reported)

Vendor	Product	Versions
Broadcom	CA Client Automation (ITCM)	14.5 CU7

Weakness: CWE-269, CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References