Devolutions

Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier

CVE-2025-2280 - March 13, 2025

Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature.

Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier

CVE-2025-2278 - March 13, 2025

Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.

Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier

CVE-2025-2277 - March 13, 2025

Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.

Insufficiently Protected Credentials

Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows

CVE-2025-1636 - March 13, 2025

Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.

Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows

CVE-2025-1635 - March 13, 2025

Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic.

Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier

CVE-2025-2003 - March 05, 2025

Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.

AuthZ

Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier

CVE-2025-1231 - February 11, 2025

Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.

Weak Password Recovery Mechanism for Forgotten Password

Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows

CVE-2025-1193 - February 10, 2025

Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack by presenting a certificate for a different host.

Improper Certificate Validation

Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux

CVE-2024-11621 - February 10, 2025

Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected are : Remote Desktop Manager macOS 2024.3.9.0 and earlier Remote Desktop Manager Linux 2024.3.2.5 and earlier Remote Desktop Manager Android 2024.3.3.7 and earlier Remote Desktop Manager iOS 2024.3.3.0 and earlier Remote Desktop Manager Powershell 2024.3.6.0 and earlier

Improper Certificate Validation

Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user

CVE-2024-12149 - December 04, 2024

Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.

Incorrect Permission Assignment for Critical Resource

Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier

CVE-2024-12148 - December 04, 2024

Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.

AuthZ

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier

CVE-2024-12151 - December 04, 2024

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.

Incorrect Permission Assignment for Critical Resource

Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier

CVE-2024-12196 - December 04, 2024

Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.

AuthZ

Devolutions Remote Desktop Manager: Incorrect Authorization in Permission Validation Component

CVE-2024-11670 - November 25, 2024

Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via specific actions.

AuthZ

Devolutions Remote Desktop Manager: Improper Authentication Bypass in SQL Data Source MFA Validation

CVE-2024-11671 - November 25, 2024

Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching.

Devolutions Remote Desktop Manager: Incorrect Authorization in Add Permission Component

CVE-2024-11672 - November 25, 2024

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.

AuthZ

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows

CVE-2024-7421 5.5 - Medium - September 25, 2024

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions

Insertion of Sensitive Information into Log File

Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier

CVE-2024-6512 6.5 - Medium - September 25, 2024

Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.

AuthZ

Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows

CVE-2024-6492 - July 16, 2024

Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website.

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows

CVE-2024-6354 - June 26, 2024

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.

Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier

CVE-2024-4846 - June 25, 2024

Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker

CVE-2024-6057 - June 17, 2024

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker

CVE-2024-6055 - June 17, 2024

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file.

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier

CVE-2024-5072 - May 17, 2024

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request.

Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier

CVE-2024-3545 - April 09, 2024

Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a computer where the software is installed even though the offline mode is disabled.

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier

CVE-2024-2918 - April 09, 2024

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request.

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier

CVE-2024-2921 - March 26, 2024

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions.

Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier

CVE-2024-2915 - March 26, 2024

Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request.

Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker

CVE-2024-2403 5.9 - Medium - March 13, 2024

Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory.

Insufficient Cleanup

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0

CVE-2024-1901 - March 05, 2024

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable.

Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier

CVE-2024-1898 4.3 - Medium - March 05, 2024

Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an administrator.

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier

CVE-2024-1900 - March 05, 2024

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The user will stay authenticated until the Devolutions Server token expiration.

Insufficient Session Expiration

Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier

CVE-2024-1764 - March 05, 2024

Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated privilege even after the expiration under specific circumstances

Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows

CVE-2024-0589 5.4 - Medium - January 31, 2024

Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker with access to a data source to inject a malicious script via a specially crafted input in an entry.

XSS

Inadequate validation of permissions when employing remote tools and macros

CVE-2023-7047 4.4 - Medium - December 21, 2023

Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. This affects only SQL data sources.

Offline mode is always enabled, even if permission dis

CVE-2023-6588 6.5 - Medium - December 07, 2023

Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline.

Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0

CVE-2023-6264 5.3 - Medium - November 22, 2023

Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints.

Information Disclosure

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier

CVE-2023-5358 5.3 - Medium - November 01, 2023

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters.

A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows

CVE-2023-5766 9.8 - Critical - November 01, 2023

A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a specially crafted TCP packet.

Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker

CVE-2023-5575 6.5 - Medium - October 16, 2023

Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via a specific combination of permissions in the entry and in its parent.

Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier

CVE-2023-5240 7.5 - High - October 13, 2023

Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.

Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights

CVE-2023-4373 9.8 - Critical - August 21, 2023

Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.

authentification

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier

CVE-2023-2400 2.7 - Low - June 20, 2023

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access.

Insufficient Cleanup

Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier

CVE-2023-2445 4.9 - Medium - May 02, 2023

Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name.

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows

CVE-2023-2282 6.5 - Medium - April 25, 2023

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector.

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS

CVE-2023-2257 7.8 - High - April 24, 2023

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.

AuthZ

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below 

CVE-2023-2118 5.4 - Medium - April 21, 2023

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.

Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier

CVE-2023-1980 6.5 - Medium - April 11, 2023

Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via the application user interface and open entries.

No access control for the OTP key   on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions

CVE-2023-1939 4.3 - Medium - April 11, 2023

No access control for the OTP key   on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

Incorrect Permission Assignment for Critical Resource

Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog

CVE-2023-1574 6.5 - Medium - April 02, 2023

Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.

Insufficiently Protected Credentials