Portal
Forum
Devolutions Force
Devolutions Hub Business
Devolutions Hub Personal
Devolutions Send
Devolutions Academy
RDM
Workspace
Launcher
Security & Compliance
DEVO-2025-0004
Zusammenfassung
Remote Desktop Manager and Devolutions Server are affected by vulnerabilities.
Betroffene Produkte
Remote Desktop Manager 2024.3.29 and earlier
Devolutions Server 2024.3.13 and earlier
Änderungsprotokoll
2025/03/13 - Initial publication 2025/03/26 - Updated fixed versions due to backporting the security fixes.
Schweregrad
Medium
Produkt
Devolutions Server, Remote Desktop Manager
Behobene Version
Multiple versions
Exposure of sensitive information in My Personal Credentials password history component
Beschreibung
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.
Behebungen und Workarounds
Upgrade to Remote Desktop Manager 2024.3.31 or higher
Schweregrad
6.9 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Betroffene Produkte
Remote Desktop Manager 2024.3.29 and earlier
CVE(s)
CVE-2025-1636
Exposure of sensitive information in hub data source export feature
Beschreibung
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to involuntary include his authenticated session in the export due to faulty business logic.
Behebungen und Workarounds
Upgrade to Remote Desktop Manager 2024.3.31 or higher
Schweregrad
6.8 Medium - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Betroffene Produkte
Remote Desktop Manager 2024.3.29 and earlier
CVE(s)
CVE-2025-1635
Exposure of password in web-based SSH authentication component
Beschreibung
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
Behebungen und Workarounds
Upgrade to Devolutions Server 2024.3.14 or higher
Schweregrad
6.8 Medium - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Betroffene Produkte
Devolutions Server 2024.3.13 and earlier
CVE(s)
CVE-2025-2277
Improper access control in temporary access requests and checkout requests endpoints
Beschreibung
Improper access control in temporary access request and checkout request endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.
Behebungen und Workarounds
Upgrade to Devolutions Server 2024.3.14 or higher
Schweregrad
2.3 Low - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Betroffene Produkte
Devolutions Server 2024.3.13 or earlier
CVE(s)
CVE-2025-2278
Improper access control in web extension restriction feature
Beschreibung
Improper access control in web extension restriction feature in Devolutions Server 2024.3.4 and earlier allows an authenticated user to bypass the browser extension restriction feature.
Behebungen und Workarounds
Upgrade to Devolutions Server 2024.3.6 or higher
Schweregrad
Medium 5.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Betroffene Produkte
Devolutions Server 2024.3.4 and earlier
CVE(s)
CVE-2025-2280
