CVE-2023-5240
First published: Fri Oct 13 2023(Updated: )
Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.
Credit: security@devolutions.net security@devolutions.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Devolutions Devolutions Server | <=2023.2.8.0 | |
| <=2023.2.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue in Devolutions Server?
The vulnerability ID for this issue in Devolutions Server is CVE-2023-5240.
What is the severity of CVE-2023-5240?
CVE-2023-5240 has a severity rating of 7.5 (high).
What is the affected version of Devolutions Server?
Devolutions Server 2023.2.8.0 and earlier versions are affected by this vulnerability.
How can an attacker exploit this vulnerability?
An attacker with permission to manage PAM propagation scripts can retrieve passwords stored in it via a GET request.
Is there a fix available for this vulnerability?
For information about the fix for CVE-2023-5240, please refer to the following advisory: https://devolutions.net/security/advisories/DEVO-2023-0017
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/devolutions
- canonical/devolutions devolutions server
- version/devolutions devolutions server/2023.2.8.0