CVE-2025-6942
- State
- Published
- Severity
- 3.8 Low
- Published
- Jul 2, 2025
- Updated
- Jul 2, 2025
- Reserved
- Jun 30, 2025
Description
The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.8 Low | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L | Delinea |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Secret ServerDelinea |
|
References
- https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000060.htmrelease-notes
- https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000061.htmrelease-notes
- https://docs.delinea.com/online-help/secret-server-changelog/secret-server-change-log.htm?cshid=secret-server-changelog#Friday,_November_22,_2024release-notes
- https://trust.delinea.com/?tcuUid=2b68edca-7930-438d-b960-2d6da07cdde9vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.