CVE-2022-3781

2022-11-0118:28:28

CWE-311

DEVOLUTIONS

www.cve.org

cve-2022-3781; devolutions remote desktop manager; devolutions server; database encryption; account settings; data security; passwords; cve

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data.

This issue affects :
Remote Desktop Manager 2022.2.26 and prior versions.

Devolutions Server 2022.3.1 and prior versions.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Remote Desktop Manager",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": "2022.2.26",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Devolutions Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": "2022.3.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2022-0009