CVE-2024-1900: Medium severity devolutions server vulnerability
Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365.
The user will stay authenticated until the Devolutions Server token expiration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1900?
CVE-2024-1900 has a medium severity rating due to the potential for unauthorized access after account deletion in the identity provider.
How do I fix CVE-2024-1900?
To fix CVE-2024-1900, upgrade Devolutions Server to version 2023.3.14.1 or later that addresses the session management issue.
What versions of Devolutions Server are affected by CVE-2024-1900?
CVE-2024-1900 affects Devolutions Server versions 2023.3.14.0 and earlier.
What is the impact of CVE-2024-1900 on users?
The impact of CVE-2024-1900 allows disabled or deleted users in the identity provider to remain authenticated in Devolutions Server.
Is there a workaround available for CVE-2024-1900?
There is no documented workaround for CVE-2024-1900, and upgrading to the patched version is recommended.