Insufficient Access Control in Devolutions Server Software
CVE-2023-2118

5.4MEDIUM

Key Information:

Vendor

Devolutions

Status
Devolutions Server
Vendor
CVE Published:
21 April 2023

What is CVE-2023-2118?

This vulnerability presents an insufficient access control issue within the support ticket feature of Devolutions Server versions 2023.1.5.0 and prior. It allows authenticated attackers to exploit specific endpoints to send support tickets and download sensitive diagnostic files, potentially compromising system integrity.

Affected Version(s)

Devolutions Server Windows 0 < 2023.1.6.0

References

https://devolutions.net/security/advisories/DEVO-2023-0010

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jico
.