Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-42006: Keyfactor AWS Orchestrator 2.0 Leaks Sensitive Data

CVE-2024-42006 · published 2 years ago

Summary

The Keyfactor AWS Orchestrator version 2.0 has a flaw that allows unauthorized access to sensitive information. This means that attackers could potentially view confidential data that shouldn't be publicly available. To protect your data, update to the latest version of the Keyfactor AWS Orchestrator as soon as possible.

What to do

Update keyfactor aws_orchestrator to version 2.01 or later.

Affected software

Vendor	Product	Affected versions
keyfactor	aws_orchestrator	< 2.01 `cpe:2.3:a:keyfactor:aws_orchestrator::::::::`

Original advisory text

Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.

References

https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published20 Aug 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-42006 · NVD

Track software like this

Free during beta