Lucene search

[email protected]CVE-2023-2400

HistoryJun 20, 2023 - 5:15 p.m.

CVE-2023-2400

2023-06-2017:15:09

CWE-459

[email protected]

web.nvd.nist.gov

cve-2023-2400

devolutions server

user management

improper deletion

database access

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access.

Affected configurations

NVD

Node

devolutionsdevolutions_serverRange<2023.2.1

CPENameOperatorVersion
devolutions:devolutions_serverdevolutions devolutions serverlt2023.2.1

CPE	Name	Operator	Version
devolutions:devolutions_server	devolutions devolutions server	lt	2023.2.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "User Management"
    ],
    "product": "Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": "2023.1.8",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0014

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Related for CVE-2023-2400

nvd1 prion1 cvelist1