{"id":"CVE-2024-45744","aliases":["EUVD-2024-41577","GHSA-8xf3-x93c-2ch6"],"status":"published","title":"TopQuadrant TopBraid EDG password manager stores external credentials insecurely","description":"TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.","severity":{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00222,"percentile":0.12944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-257","CWE-312","CWE-522"],"published":"2024-09-27T15:56:11Z","modified":"2026-06-17T07:54:44Z","products":[{"vendor":"topquadrant","product":"topbraid edg"},{"vendor":"topquadrant","product":"topbraid_edg"}],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json","tags":["Third Party Advisory"]},{"url":"https://www.topquadrant.com/doc/latest/reference/PasswordManagementAdminPage.html","tags":["Technical Description"]},{"url":"https://www.topquadrant.com/doc/latest/administrator_guide/edg_installation_and_authentication/hashicorp_integration.html","tags":["Technical Description"]},{"url":"https://www.topquadrant.com/release-note/7-3/","tags":["Release Notes"]},{"url":"https://www.topquadrant.com/wp-content/uploads/2025/02/changes-8.3.0.txt","tags":["Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45744"},{"url":"https://www.topquadrant.com/release-note/7-3"},{"url":"https://github.com/advisories/GHSA-8xf3-x93c-2ch6"}],"sources":{"cve":[{"id":"CVE-2024-45744","title":"TopQuadrant TopBraid EDG password manager stores external credentials insecurely","description":"TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.","status":"published","published":"2024-09-27T15:56:11.98Z","modified":"2025-10-02T14:09:27.993Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-257","CWE-312"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-41577","description":"TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.","status":"published","published":"2024-09-27T15:56:11Z","modified":"2025-10-02T14:09:27Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:31:37.123578Z"}],"ghsa":[{"id":"GHSA-8xf3-x93c-2ch6","title":"TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with...","description":"TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally.","status":"published","published":"2024-09-27T18:32:25Z","modified":"2025-09-22T18:31:34Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-257","CWE-522"],"updated_at":"2026-11-02T15:03:40.93695Z"}],"nvd":[{"id":"CVE-2024-45744","description":"TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.","status":"published","published":"2024-09-27T16:15:04.94Z","modified":"2026-06-17T07:54:44.21Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-257","CWE-312","CWE-522"],"updated_at":"2026-11-02T14:10:29.044588Z"}]}}