Portail
Forum
Devolutions Force
Hub Business
Hub Personal
Devolutions Send
Devolutions Academy
RDM
Workspace
Launcher
Sécurité et conformité
DEVO-2025-0004
Résumé
Remote Desktop Manager and Devolutions Server are affected by vulnerabilities.
Produits affectés
Remote Desktop Manager 2024.3.29 and earlier
Devolutions Server 2024.3.13 and earlier
Journal des modifications
2025/03/13 - Initial publication 2025/03/26 - Updated fixed versions due to backporting the security fixes.
Sévérité
Medium
Produit
Devolutions Server, Remote Desktop Manager
Version corrigée
Multiple versions
Exposure of sensitive information in My Personal Credentials password history component
Description
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.
Mesures correctives et solutions de contournement
Upgrade to Remote Desktop Manager 2024.3.31 or higher
Sévérité
6.9 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produits affectés
Remote Desktop Manager 2024.3.29 and earlier
CVE(s)
CVE-2025-1636
Exposure of sensitive information in hub data source export feature
Description
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to involuntary include his authenticated session in the export due to faulty business logic.
Mesures correctives et solutions de contournement
Upgrade to Remote Desktop Manager 2024.3.31 or higher
Sévérité
6.8 Medium - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produits affectés
Remote Desktop Manager 2024.3.29 and earlier
CVE(s)
CVE-2025-1635
Exposure of password in web-based SSH authentication component
Description
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2024.3.14 or higher
Sévérité
6.8 Medium - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produits affectés
Devolutions Server 2024.3.13 and earlier
CVE(s)
CVE-2025-2277
Improper access control in temporary access requests and checkout requests endpoints
Description
Improper access control in temporary access request and checkout request endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2024.3.14 or higher
Sévérité
2.3 Low - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produits affectés
Devolutions Server 2024.3.13 or earlier
CVE(s)
CVE-2025-2278
Improper access control in web extension restriction feature
Description
Improper access control in web extension restriction feature in Devolutions Server 2024.3.4 and earlier allows an authenticated user to bypass the browser extension restriction feature.
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2024.3.6 or higher
Sévérité
Medium 5.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produits affectés
Devolutions Server 2024.3.4 and earlier
CVE(s)
CVE-2025-2280
