cve.bz

CVE-2024-38499

7.3 highEPSS 0.2%

High (7.3). EPSS 0.2% chance of exploitation in the next 30 days.

CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.

Severity

CVSS 4.0

7.3 high
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWEs
CWE-269, CWE-276
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON