CVE-2025-2280: High severity Devolutions Server vulnerability
Published Mar 13, 2025
·Updated
Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0
and earlier allows an authenticated user to bypass the browser extension restriction feature.
Affected Software
2 affected components
Devolutions Server<2024.3.4.0
Devolutions Devolutions Server<2024.3.6.0
Event History
Mar 13, 2025
CVE Published
via MITRE·01:02 PM
Data Sourced
via MITRE·01:02 PM
DescriptionWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-2280?
CVE-2025-2280 is considered a critical vulnerability due to the improper access control allowing authenticated users to bypass restrictions.
2
How do I fix CVE-2025-2280?
To fix CVE-2025-2280, update Devolutions Server to version 2024.3.14 or later immediately.
3
Who is affected by CVE-2025-2280?
CVE-2025-2280 affects all versions of Devolutions Server up to and including 2024.3.13.
4
What conditions must be present for CVE-2025-2280 to be exploited?
An authenticated user must attempt to bypass browser extension restrictions for CVE-2025-2280 to be exploited.
5
Is there a workaround for CVE-2025-2280 until I can update?
There are no specific workarounds for CVE-2025-2280, so it's critical to apply the update as soon as possible.