Lucene search

DEVOLUTIONSCVE-2023-2400

HistoryJun 20, 2023 - 5:15 p.m.

CVE-2023-2400

2023-06-2017:15:09

CWE-459

DEVOLUTIONS

web.nvd.nist.gov

cve-2023-2400

devolutions server

user management

improper deletion

database access

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access.

Affected configurations

Nvd

Node

devolutionsdevolutions_serverRange<2023.2.1

VendorProductVersionCPE
devolutionsdevolutions_server*cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devolutions	devolutions_server	*	cpe:2.3:a:devolutions:devolutions_server::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "User Management"
    ],
    "product": "Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": "2023.1.8",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0014

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

Related for CVE-2023-2400