Portail 
Forum 
Devolutions Force 
Hub Business 
Hub Personal 
Devolutions Send 
Devolutions Academy 
RDM 
Workspace 
Launcher 
Sécurité et conformité
Nous respectons les normes les plus élevées pour protéger vos données et garantir la confiance.
DEVO-2025-0016
Devolutions Server is affected by multiple vulnerabilities.
Produits affectés
Journal des modifications
6/11/2025 - Initial publication
9.4 Critical - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Improper privilege management during pre-MFA cookie handling
Improper privilege management during pre-MFA cookie handling in Devolutions Server 2025.3.5.0 and earlier allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.
This does not bypass the target account MFA verification step.
Produits affectés
CVE(s)
CVE-2025-12485
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2025.3.6.0 or higher
7.1 High - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Improper access control in in Devolutions Server in sensitive third-level fields
Improper access control in Devolutions Server 2025.3.5.0 and earlier allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure.
Produits affectés
CVE(s)
CVE-2025-12808
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2025.3.6.0 or higher
