Skip to content
OpenAdvisories
Medium VA-24-254-02 2 CVEs

TopQuadrant TopBraid EDG Insecure External Password Storage and XXE Vulnerabilities

Published Sep 10, 2024 · Updated Feb 13, 2025 · Revision 5

Vendor: TopQuadrant Product: TopBraid EDG

Summary

TopQuadrant TopBraid EDG stores credentials for external services insecurely and processes untrusted XML entities. An authenticated attacker could obtain credentials for remote services, read local files, or access URLs.

Vulnerabilities 2

  • Medium 5.0
    CVE-2024-45745

    TopQuadrant TopBraid EDG JavaScript console XXE

    TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access URLs (XXE). Fixed in 8.0.1 (bug fix: TBS-6721).

    TopQuadrant TopBraid EDG
  • Low 3.0
    CVE-2024-45744

    TopQuadrant TopBraid EDG password manager stores external credentials insecurely

    TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker coul…

    TopQuadrant TopBraid EDG

Revision history

  1. #1.0.4

    Added mitigations for CVE-2024-45744

  2. #1.0.3

    Added Hashicorp Vault mitigation, Recommended Practices section, language

  3. #1.0.2

    Fix acknowledgements, section headings, version range

  4. #1.0.1

    Correct reporter affiliation from RAF to FAST

  5. #1.0.0

    Initial publication