Lucene search

DEVOLUTIONSVULNRICHMENT:CVE-2024-6057

HistoryJun 17, 2024 - 1:10 p.m.

CVE-2024-6057

2024-06-1713:10:42

DEVOLUTIONS

github.com

cve-2024-6057

improper authentication

devolutions remote desktop manager

vault password

bypass

offline mode

compromised access

AI Score

7.4

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:*:*:*"
    ],
    "vendor": "devolutions",
    "product": "remote_desktop_manager",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2024.1.31.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

devolutions.net/security/advisories/DEVO-2024-0008