Improper Access Control in Devolutions Server Affects User Vaults

CVE-2023-2445

What is CVE-2023-2445?

A significant access control vulnerability exists in Devolutions Server 2023.1.1 and earlier, enabling attackers with administrative privileges to access sensitive usage information pertaining to folders within user vaults. This is achieved through the exploitation of the Subscriptions Folder path filter, allowing unauthorized retrieval of folder details using specific folder names.

References