PAM JIT Elevation Feature Vulnerability

CVE-2024-2918

What is CVE-2024-2918?

An improper input validation flaw in the PAM JIT (Just-In-Time) elevation feature of Devolutions Server versions 2024.1.6 and earlier allows a malicious actor with access to the PAM JIT elevation functionality to manipulate the group that is displayed in the checkout request. This exploit can lead to unauthorized actions and potential compromise of sensitive permissions within the system. Organizations using affected versions of Devolutions Server should apply the necessary updates to mitigate this risk.

References