Improper access control

2023-04-2122:15:00

PRIOn knowledge base

www.prio-n.com

improper access control

devolutions server

authenticated attacker

support tickets

diagnostic files

specific endpoints

5.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.5%

JSON

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.

CPENameOperatorVersion
devolutions_serverlt2023.1.6.0

CPE	Name	Operator	Version
	devolutions_server	lt	2023.1.6.0

References

devolutions.net/security/advisories/DEVO-2023-0010