Improper access control

2023-11-0118:15:00

PRIOn knowledge base

www.prio-n.com

access control

report log filters

devolutions server 2023.2.10.0

attackers

retrieve logs

vaults

report request

url query parameters

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters.

CPENameOperatorVersion
devolutions_serverlt2023.3.4.0

CPE	Name	Operator	Version
	devolutions_server	lt	2023.3.4.0

References

devolutions.net/security/advisories/DEVO-2023-0019/