Lucene search

DEVOLUTIONSCVE-2023-1939

HistoryApr 11, 2023 - 6:15 p.m.

CVE-2023-1939

2023-04-1118:15:58

CWE-732

DEVOLUTIONS

web.nvd.nist.gov

cve-2023-1939

devolutions remote desktop manager

access control

otp key

security vulnerability

nvd

non admin users

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

No access control for the OTP key

on OTP entries

in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

Affected configurations

Nvd

Node

devolutionsremote_desktop_managerRange≤2022.3.2.0linux

devolutionsremote_desktop_managerRange≤2022.3.33.0windows

VendorProductVersionCPE
devolutionsremote_desktop_manager*cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:linux:*:*
devolutionsremote_desktop_manager*cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
devolutions	remote_desktop_manager	*	cpe:2.3:a:devolutions:remote_desktop_manager::::::linux::*
devolutions	remote_desktop_manager	*	cpe:2.3:a:devolutions:remote_desktop_manager::::::windows::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Remote Desktop Manager",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThan": "2022.3.34.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Remote Desktop Manager",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThan": "2022.3.2.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0009

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

Related for CVE-2023-1939