CVE-2023-1939

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2023-0009	Vendor Advisory
https://devolutions.net/security/advisories/DEVO-2023-0009	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:devolutions:remote_desktop_manager::::::linux::*
	cpe:2.3:a:devolutions:remote_desktop_manager::::::windows::*

History

21 Nov 2024, 07:40

Type	Values Removed	Values Added
References	~~() https://devolutions.net/security/advisories/DEVO-2023-0009 - Vendor Advisory~~	() https://devolutions.net/security/advisories/DEVO-2023-0009 - Vendor Advisory

21 Apr 2023, 17:59

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
References	~~(MISC) https://devolutions.net/security/advisories/DEVO-2023-0009 -~~	(MISC) https://devolutions.net/security/advisories/DEVO-2023-0009 - Vendor Advisory
First Time		Devolutions Devolutions remote Desktop Manager
CWE		CWE-732
CPE		cpe:2.3:a:devolutions:remote_desktop_manager::::::linux::* cpe:2.3:a:devolutions:remote_desktop_manager::::::windows::*

11 Apr 2023, 18:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-04-11 18:15

Updated : 2025-02-10 19:15

NVD link : CVE-2023-1939

Mitre link : CVE-2023-1939

CVE.ORG link : CVE-2023-1939

JSON object : View

Products Affected

devolutions

remote_desktop_manager

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2023-1939", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-04-11T18:15:58.447", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2023-0009", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}, {"url": "https://devolutions.net/security/advisories/DEVO-2023-0009", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "No access control for the OTP key\u00a0\n\n\u00a0on OTP entries\n\n in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface."}], "lastModified": "2025-02-10T19:15:36.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "4F3171EE-56B5-4A43-AC2A-5B240D2510FC", "versionEndIncluding": "2022.3.2.0"}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "E03C94F7-13B7-437F-9C4D-0FE41B267CDF", "versionEndIncluding": "2022.3.33.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}