Portal
Forum
Devolutions Force
Hub Business
Hub Personal
Devolutions Send
RDM
Workspace
Launcher
Security & Compliance
DEVO-2022-0006
Summary
Multiple vulnerabilities were fixed in Devolutions Server 2022.2.
Affected Products
Devolutions Server 2022.1 and earlier
Change Log
Initial Publication - 2022-07-05
Severity
High
Product
Devolutions Server
Fix Version
2022.2
HTML injection in the secure message title
Description
Some HTML tags could be injected in the title of secure messages. Javascript code execution via this injection is not possible due to sanitizing done by the Angular framework. An attacker with access to Devolutions Server could use it to alter the rendering of the page or redirect a user to another site.
Remediation and Workarounds
Upgrade to Devolutions Server 2022.2
Severity
Low - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected Products
Devolutions Server 2022.1 and earlier
CVE(s)
CVE-2022-2316
Incorrect handling of permissions when creating a user with a pre-existing username
Description
When deleting a user, the permission assignments remained in the database. If a new user was created with the same username, the user would get the permissions of that previous user.
Starting with Devolutions Server 2022.2, permissions are assigned based on the user unique ID instead of its username.
Remediation and Workarounds
Upgrade to Devolutions Server 2022.2
Severity
High - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected Products
Devolutions Server 2022.1 and earlier
CVE(s)
CVE-2022-33996