Secret Server vulnerabilities

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.