CVE-2024-38499

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-38505.4Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on CVE-2024-385016.1An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-pri CVE-2024-385027.1An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-385035.4When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential expl CVE-2024-385045.3In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles CVE-2024-385057.5In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site CVE-2024-385068.1In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows CVE-2024-385075.4In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible CVE-2024-385087.2A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an a CVE-2024-385097.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute ar CVE-2024-38515.4A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads CVE-2024-385107.2A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wi