CVE-2023-0953

2023-02-2213:42:04

DEVOLUTIONS

www.cve.org

sql injection

unauthorized access

documentation feature

devolutions server

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Devolutions Server",
    "vendor": "Devolutions",
    "versions": [
      {
        "lessThanOrEqual": "2022.3.12",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0003