Lucene search

DEVOLUTIONSCVE-2023-5575

HistoryOct 16, 2023 - 2:15 p.m.

CVE-2023-5575

2023-10-1614:15:10

DEVOLUTIONS

web.nvd.nist.gov

cve-2023-5575

devolutions server

access control

permission inheritance

security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via a specific combination of permissions in the entry and in its parent.

Affected configurations

Nvd

Node

devolutionsdevolutions_serverRange≤2022.3.13.0

VendorProductVersionCPE
devolutionsdevolutions_server*cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devolutions	devolutions_server	*	cpe:2.3:a:devolutions:devolutions_server::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Permissions"
    ],
    "product": "Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": " 2022.3.13.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0018

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2023-5575