Improper Password Reset in Devolutions Server by Devolutions
CVE-2025-1231

5.4MEDIUM

Key Information:

Vendor
Devolutions
Status
Server
Vendor
CVE Published:
11 February 2025

Summary

An issue has been identified in Devolutions Server versions 2024.3.10.0 and earlier, where improper password reset mechanisms allow authenticated users to reuse the oracle user password after a system crash during the reset process. This flaw could lead to unauthorized access if the password is not properly managed, highlighting the need for timely updates and secure password management practices.

Affected Version(s)

Server 0 <= 2024.3.10.0

References

https://devolutions.net/security/advisories/DEVO-2025-0002/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.