CVE-2023-5240: High severity devolutions server vulnerability
Published Oct 13, 2023
·Updated
Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.
Affected Software
1 affected component
Devolutions Devolutions Server<=2023.2.8.0
Event History
Oct 13, 2023
CVE Published
via MITRE·12:22 PM
Data Sourced
via MITRE·12:22 PM
Description
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue in Devolutions Server?
The vulnerability ID for this issue in Devolutions Server is CVE-2023-5240.
2
What is the severity of CVE-2023-5240?
CVE-2023-5240 has a severity rating of 7.5 (high).
3
What is the affected version of Devolutions Server?
Devolutions Server 2023.2.8.0 and earlier versions are affected by this vulnerability.
4
How can an attacker exploit this vulnerability?
An attacker with permission to manage PAM propagation scripts can retrieve passwords stored in it via a GET request.
5
Is there a fix available for this vulnerability?
For information about the fix for CVE-2023-5240, please refer to the following advisory: https://devolutions.net/security/advisories/DEVO-2023-0017