Lucene search

[email protected]NVD:CVE-2022-33996

HistoryJul 07, 2022 - 12:15 p.m.

CVE-2022-33996

2022-07-0712:15:09

CWE-276

[email protected]

web.nvd.nist.gov

cve-2022-33996

devolutions server

permission management

new user

preexisting username

inherit permissions

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.8%

JSON

Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user.

Affected configurations

Nvd

Node

devolutionsdevolutions_serverRange<2022.2.0

VendorProductVersionCPE
devolutionsdevolutions_server*cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devolutions	devolutions_server	*	cpe:2.3:a:devolutions:devolutions_server::::::::

References

devolutions.net

devolutions.net/security/advisories/DEVO-2022-0006

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.8%

JSON

Related for NVD:CVE-2022-33996

cvelist1 prion1 cve1