CVE-2023-0953

Published Mar 1, 2023

Last updated a year ago

Overview

Description: Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources.
Source: security@devolutions.net
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-89

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6A1ABDAA-CAE5-4CE3-8DB4-245062DAF575",
            "versionEndIncluding": "2022.3.12"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References