Code injection

2023-01-2621:18:00

PRIOn knowledge base

www.prio-n.com

code injection

devolutions

remote desktop manager

mfa bypass

sensitive data disclosure

security vulnerability

4.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user to save sensitive data on disk.

CPENameOperatorVersion
remote_desktop_managereq2022.3.29
remote_desktop_managereq2022.3.30

CPE	Name	Operator	Version
	remote_desktop_manager	eq	2022.3.29
	remote_desktop_manager	eq	2022.3.30

References

devolutions.net/security/advisories/DEVO-2023-0001