CVE-2024-5072

Published May 17, 2024

Last updated 22 days ago

CVSS medium 6.5

Overview

Description: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request.
Source: security@devolutions.net
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E2815D8D-64A2-4765-B1D8-FD2B85F1388A",
            "versionEndExcluding": "2024.1.12.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References