Vulnerability · Published Sep 27, 2024 · Assigned by cisa-cg
CVE-2024-45744TopQuadrant TopBraid EDG password manager stores external credentials insecurely
Low 3.0
In plain English
A low-severity security flaw in TopBraid EDG from TopQuadrant. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TopQuadrant | TopBraid EDG | 7.1.3 |
Weakness: CWE-257, CWE-312 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N