{"timestamp":"2024-09-27T17:44:24.546908Z","id":"CVE-2024-45744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"TopQuadrant","product":"TopBraid EDG","defaultStatus":"unknown","versions":[{"version":"7.1.3","status":"affected"}]}]

CWE-312

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-522

OR
          *cpe:2.3:a:topquadrant:topbraid_edg:7.1.3:*:*:*:*:*:*:*

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json Types: Third Party Advisory

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.topquadrant.com/doc/latest/administrator_guide/edg_installation_and_authentication/hashicorp_integration.html Types: Technical Description

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.topquadrant.com/doc/latest/reference/PasswordManagementAdminPage.html Types: Technical Description

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.topquadrant.com/release-note/7-3/ Types: Release Notes

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.topquadrant.com/wp-content/uploads/2025/02/changes-8.3.0.txt Types: Release Notes

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally.

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.

https://www.topquadrant.com/wp-content/uploads/2025/02/changes-8.3.0.txt

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. 
At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally.

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally.

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. 
At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally.

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-257

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json [No types assigned]

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.topquadrant.com/doc/latest/administrator_guide/edg_installation_and_authentication/hashicorp_integration.html [No types assigned]

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.topquadrant.com/doc/latest/reference/PasswordManagementAdminPage.html [No types assigned]

Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.topquadrant.com/release-note/7-3/ [No types assigned]