CVE-2024-36460

What it actually does

The front-end audit log exposes plaintext passwords in clear text, allowing any user with access to the interface to read stored credentials without decryption.

Why it matters to the business

Compromised passwords enable attackers to impersonate users, access protected resources, and escalate privileges across systems relying on this component, increasing breach risk and compliance exposure.

How an attack unfolds

An attacker with low-privilege front-end access views the audit log entries where passwords appear unmasked, directly harvesting credentials for further attacks.

How to fix it

Upgrade cyrus-sasl-sql on AlmaLinux 8 to version 2.1.27-5.el8 or later; restrict audit log access to the minimum necessary roles until patched.

How to confirm the fix worked

Confirm cyrus-sasl-sql package version is 2.1.27-5.el8 or higher; review sample audit log output to verify passwords are no longer displayed in plaintext.

Typical attack path

1. Gain authenticated access to the front-end interface
2. Navigate to the audit log viewer
3. Search or filter log entries containing password fields
4. Copy exposed plaintext credentials for reuse or lateral movement

How to detect it

Review front-end audit logs for entries that contain visible password strings; inspect access logs to the audit log interface for unexpected user activity.

What your security team should do

• Apply the fixed package version immediately on all affected AlmaLinux 8 systems
• Audit current permissions on the front-end audit log feature
• Enable or enforce credential masking in logging configuration
• Monitor EPSS and exploit maturity for any increase in risk