Lucene search

[email protected]CVE-2023-0951

HistoryMar 01, 2023 - 8:15 a.m.

CVE-2023-0951

2023-03-0108:15:11

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2023-0951

improper access controls

api endpoints

devolutions server

privileged user

security vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

31.5%

JSON

Improper access controls on some API endpoints in Devolutions Server 2022.3.12
and earlier could allow a standard privileged user to perform privileged
actions.

CPENameOperatorVersion
devolutions:devolutions_serverdevolutions devolutions serverle2022.3.12
devolutions:devolutions_serverdevolutions devolutions servereq2020.1.13.0
devolutions:devolutions_serverdevolutions devolutions servereq2020.3.12.0
devolutions:devolutions_serverdevolutions devolutions servereq2022.3.2
devolutions:devolutions_serverdevolutions devolutions servereq2019.1.12.0
devolutions:devolutions_serverdevolutions devolutions servereq2019.1.8.0
devolutions:devolutions_serverdevolutions devolutions servereq2022.3.3.0
devolutions:devolutions_serverdevolutions devolutions servereq2021.1
devolutions:devolutions_serverdevolutions devolutions servereq2022.3.9.0
devolutions:devolutions_serverdevolutions devolutions servereq2019.1.15.0

CPE	Name	Operator	Version
devolutions:devolutions_server	devolutions devolutions server	le	2022.3.12
devolutions:devolutions_server	devolutions devolutions server	eq	2020.1.13.0
devolutions:devolutions_server	devolutions devolutions server	eq	2020.3.12.0
devolutions:devolutions_server	devolutions devolutions server	eq	2022.3.2
devolutions:devolutions_server	devolutions devolutions server	eq	2019.1.12.0
devolutions:devolutions_server	devolutions devolutions server	eq	2019.1.8.0
devolutions:devolutions_server	devolutions devolutions server	eq	2022.3.3.0
devolutions:devolutions_server	devolutions devolutions server	eq	2021.1
devolutions:devolutions_server	devolutions devolutions server	eq	2022.3.9.0
devolutions:devolutions_server	devolutions devolutions server	eq	2019.1.15.0

Rows per page:

1-10 of 491

References

devolutions.net/security/advisories/DEVO-2023-0003

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

31.5%

JSON

Related for CVE-2023-0951

cvelist1 prion1