Description
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Delinea | Secret Server (On-Prem) | 10.5.1 – ≤ 12.1.3 | — |
References
- https://delinea.com/security-advisories vendor-advisory