Portal 
Forum 
Devolutions Force 
Devolutions Hub Business 
Devolutions Hub Personal 
Devolutions Send 
Devolutions Academy 
RDM 
Workspace 
Launcher 
Sicherheit & Regelkonformität
Wir halten die höchsten Standards ein, um Ihre Daten zu schützen und Vertrauen zu gewährleisten.
DEVO-2025-0018
Devolutions Server is affected by multiple vulnerabilities.
Betroffene Produkte
Änderungsprotokoll
2025-11-27 - Initial publication
9.4 Critical - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SQL injection in last usage logs
An SQL injection via the DateSortField parameter in last usage logs allows authenticated users to exfiltrate or modify data.
Betroffene Produkte
CVE(s)
CVE-2025-13757
Behebungen und Workarounds
Upgrade to Devolutions Server 2025.2.21 or higher, 2025.3.9 or higher.
Danksagungen
JaGoTu, DCIT a.s.
Medium 5.1 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Credentials included in partial connection requests
Entries in DVLS are requested in two separate requests, the first request contains general information to be displayed such as the name, username, creation date etc. Credentials such as passwords are fetched via a /sensitive-data request when the credential is accessed by the user. Some entry types improperly included passwords in the first request.
Betroffene Produkte
CVE(s)
CVE-2025-13758
Behebungen und Workarounds
Upgrade to Devolutions Server 2025.2.21 or higher; 2025.3.9 or higher.
Danksagungen
JaGoTu, DCIT a.s.
4.9 Medium - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:N
Improper access control in email service component
The email service configuration API returned email service passwords to users without administrative rights when multiple email services where configured.
Betroffene Produkte
CVE(s)
CVE-2025-13765
Behebungen und Workarounds
Upgrade to Devolutions Server 2025.2.21 or higher; 2025.3.9 or higher
