CVE-2023-1939
Published Apr 11, 2023
Last updated 2 years ago
Overview
- Description
- No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.
- Source
- security@devolutions.net
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 4.3
- Impact score
- 1.4
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
Weaknesses
- nvd@nist.gov
- CWE-732
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:linux:*:*",
"vulnerable": true,
"matchCriteriaId": "4F3171EE-56B5-4A43-AC2A-5B240D2510FC",
"versionEndIncluding": "2022.3.2.0"
},
{
"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "E03C94F7-13B7-437F-9C4D-0FE41B267CDF",
"versionEndIncluding": "2022.3.33.0"
}
],
"operator": "OR"
}
]
}
]