Sécurité et conformité
Nous respectons les normes les plus élevées pour protéger vos données et garantir la confiance.
DEVO-2025-0018
Devolutions Server is affected by multiple vulnerabilities.
Produits affectés
Journal des modifications
2025-11-27 - Initial publication
9.4 Critical - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SQL injection in last usage logs
An SQL injection via the DateSortField parameter in last usage logs allows authenticated users to exfiltrate or modify data.
Produits affectés
CVE(s)
CVE-2025-13757
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2025.2.21 or higher, 2025.3.9 or higher.
Credits
JaGoTu, DCIT a.s.
Medium 5.1 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Credentials included in partial connection requests
Entries in DVLS are requested in two separate requests, the first request contains general information to be displayed such as the name, username, creation date etc. Credentials such as passwords are fetched via a /sensitive-data request when the credential is accessed by the user. Some entry types improperly included passwords in the first request.
Produits affectés
CVE(s)
CVE-2025-13758
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2025.2.21 or higher; 2025.3.9 or higher.
Credits
JaGoTu, DCIT a.s.
4.9 Medium - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:N
Improper access control in email service component
The email service configuration API returned email service passwords to users without administrative rights when multiple email services where configured.
Produits affectés
CVE(s)
CVE-2025-13765
Mesures correctives et solutions de contournement
Upgrade to Devolutions Server 2025.2.21 or higher; 2025.3.9 or higher