CVE-2023-6588

2023-12-0715:59:19

DEVOLUTIONS

www.cve.org

offline mode

devolutions server

workspace application

unauthorized access

credentials

6.6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.1%

JSON

Offline mode is always enabled, even if permission disallows it, in
Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and
earlier. This allows an attacker with access to the Workspace
application to access credentials when offline.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Offline Mode",
      "Devolutions Server Data Source"
    ],
    "product": "Workspace",
    "vendor": "Devolutions",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

References

devolutions.net/security/advisories/DEVO-2023-0022/