CVE-2024-45744

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.

• CWE-257
• CWE-312
• CWE-522

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.jsonThird Party Advisory
• https://www.topquadrant.com/doc/latest/administrator_guide/edg_installation_and_authentication/hashicorp_integration.htmlTechnical Description
• https://www.topquadrant.com/doc/latest/reference/PasswordManagementAdminPage.htmlTechnical Description
• https://www.topquadrant.com/release-note/7-3/Release Notes
• https://www.topquadrant.com/wp-content/uploads/2025/02/changes-8.3.0.txtRelease Notes

Published

Sep 27, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45739In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6,…4.9
• CVE-2024-4574The Graphina – Elementor Charts and Graphs plugin for WordPr…6.4
• CVE-2024-45740In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splu…5.4
• CVE-2024-45741In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splu…5.4
• CVE-2024-45742Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45743Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45745TopQuadrant TopBraid EDG before version 8.0.1 allows an auth…4.3
• CVE-2024-45746An issue was discovered in Trusted Firmware-M through 2.1.0.…9.8
• CVE-2024-4575The LayerSlider plugin for WordPress is vulnerable to Stored…6.4
• CVE-2024-45750An issue in TheGreenBow Windows Standard VPN Client 6.87.108…7.3
• CVE-2024-45751tgt (aka Linux target framework) before 1.0.93 attempts to a…5.9
• CVE-2024-45752logiops through 0.3.4, in its default configuration, allows …7.3