First published: Tue Nov 01 2022(Updated: )
Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions Server 2022.3.1 and prior versions.
Credit: security@devolutions.net security@devolutions.net
Affected Software | Affected Version | How to fix |
---|---|---|
Devolutions Devolutions Server | <2022.3.2 | |
Devolutions Remote Desktop Manager | <2022.2.27 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2022-3781.
The vulnerability affects Devolutions Remote Desktop Manager versions up to 2022.2.26 and Devolutions Server versions up to 2022.3.1.
The vulnerability exposes the Dashlane password and Keepass Server password in the My Account Settings of the database, allowing database users to directly access the unencrypted passwords.
The severity of CVE-2022-3781 is medium with a CVSS score of 6.5.
Yes, the fix for the vulnerability is available in Devolutions Remote Desktop Manager version 2022.2.27 and Devolutions Server version 2022.3.2 and later.