Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Thycotic Secret Server may leave encrypted passwords on disk

CVE-2014-4861 · published 8 years ago
Summary

The Remote Desktop Launcher in Thycotic Secret Server versions before 8.6.000010 leaves a temporary file with an encrypted password on the server after a session ends. This leftover file could be accessed by someone with access to the server’s file system, potentially exposing credentials. Update to the latest version or apply the vendor’s patch to ensure the temporary file is properly removed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
thycotic secret_server >= 7.5.000000, <= 8.6.000009
cpe:2.3:a:thycotic:secret_server:*:*:*:*:*:*:*:*
Original advisory text
The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.
The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-255Credentials Management Errors
Timeline
Published9 Mar 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-4861 · NVD
Track software like this
Free during beta