CVE-2024-45744

TopQuadrant TopBraid EDG password manager stores external credentials insecurely

State: Published
Severity: 3.0 Low
Published: Sep 27, 2024
Updated: Oct 2, 2025
Reserved: Sep 5, 2024

Description

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.

Scores

CVSS	Score	Vector	Source
3.1	3.0 Low	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N	cisa-cg

Weaknesses

CWE-257 Storing Passwords in a Recoverable Format
CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
TopBraid EDGTopQuadrant	7.1.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.