Incorrect Authorization in Password History Leads to Data Exposure
CVE-2024-12196

Currently unrated

Key Information:

Vendor

Devolutions

Status
Devolutions Server
Vendor
CVE Published:
4 December 2024

What is CVE-2024-12196?

Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.

References

https://devolutions.net/security/advisories/DEVO-2024-0017

Timeline

  • Vulnerability published

.