Lucene search

DEVOLUTIONSCVE-2023-6264

HistoryNov 22, 2023 - 7:15 p.m.

CVE-2023-6264

2023-11-2219:15:09

CWE-200

DEVOLUTIONS

web.nvd.nist.gov

cve-2023

information leak

content-security-policy

devolutions server

devolutions gateways

endpoint listing

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

20.5%

JSON

Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints.

Affected configurations

Nvd

Node

devolutionsdevolutions_serverRange<2023.3.8.0

VendorProductVersionCPE
devolutionsdevolutions_server*cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devolutions	devolutions_server	*	cpe:2.3:a:devolutions:devolutions_server::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Devolutions Gateway",
      "Content-Security-Policy"
    ],
    "product": "Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": "2023.3.7",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0020/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

20.5%

JSON

Related for CVE-2023-6264