SQL Injection Vulnerability in Devolutions Server by Devolutions
CVE-2021-28157

7.2HIGH

Key Information:

Vendor

Devolutions

Status
Devolutions Server
Vendor
CVE Published:
14 April 2021

What is CVE-2021-28157?

An SQL Injection vulnerability exists in Devolutions Server versions prior to 2021.1 and Devolutions Server LTS versions prior to 2020.3.18. This flaw allows an administrative user to inject and execute arbitrary SQL commands through a vulnerable endpoint in the API, specifically the api/security/userinfo/delete function. Such exploitation can lead to unauthorized access to the database and manipulation of sensitive data, posing significant risks to the integrity and confidentiality of the system.

References

https://devolutions.net/security/advisories/DEVO-2021-0004
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.