Sécurité et conformité

DEVO-2024-0017

Résumé

Devolutions Server and Remote Desktop Manager are affected by vulnerabilities

Produits affectés

Devolutions Server 2024.3.8.0 and earlierRemote Desktop Manager 2024.3.19.0 and earlier

Journal des modifications

2024/12/4 - Initial publication

Sévérité

High

Produit

Devolutions Server, Remote Desktop Manager

Version corrigée

See vulnerabilities for fixed versions

Incorrect authorization in report permission validation component

Description

Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.

Mesures correctives et solutions de contournement

Upgrade to Devolutions Server 2024.3.7.0 or higher

Sévérité

5.3 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Produits affectés

Devolutions Server 2024.3.6.0 and earlier

CVE(s)

CVE-2024-12148

Incorrect permission assignment in temporary access requests component

Description

Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.

Mesures correctives et solutions de contournement

Upgrade to Remote Desktop Manager 2024.3.20.0 or higher

Sévérité

8.6 High - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produits affectés

Remote Desktop Manager 2024.3.19.0 and earlier

CVE(s)

CVE-2024-12149

Incorrect permission assignment in the user migration feature

Description

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.

Mesures correctives et solutions de contournement

Upgrade to Devolutions Server 2024.3.9.0 or higher

Sévérité

2.3 Low - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Produits affectés

Devolutions Server 2024.3.8.0 and earlier

CVE(s)

CVE-2024-12151

Incorrect authorization in the view password permission component in Devolutions Server

Description

Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.

The user must have access to the entry to exploit the vulnerability.

Mesures correctives et solutions de contournement

Upgrade to Devolutions Server 2024.3.8.0 or higher

Sévérité

7.1 High - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produits affectés

Devolutions Server 2024.3.7.0 and earlier

CVE(s)

CVE-2024-12196

Devolutions aide les organisations à contrôler le chaos relié aux TI en offrant des solutions sécurisées de gestion d’accès privilégiés, de connexions à distance et de mots de passe.

DEVOLUTIONS

Légal & vie privée | infos@devolutions.net

Tous droits réservés © 2025 Devolutions