CVE-2024-38499 — Improper Privilege Management Vulnerability in CA Client Automation 14.5
CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encrypt…
Published: 2024-12-17 · CVSS: 7.3 · CVSS 4.0
CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7