Lucene search

DEVOLUTIONSCVE-2023-2118

HistoryApr 21, 2023 - 10:15 p.m.

CVE-2023-2118

2023-04-2122:15:07

DEVOLUTIONS

web.nvd.nist.gov

cve-2023-2118

access control

support ticket

devolutions server

nvd

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.

Affected configurations

Nvd

Node

devolutionsdevolutions_serverRange<2023.1.6.0

VendorProductVersionCPE
devolutionsdevolutions_server*cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devolutions	devolutions_server	*	cpe:2.3:a:devolutions:devolutions_server::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Devolutions Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThan": "2023.1.6.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0010

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

Related for CVE-2023-2118