PT-2023-17968 · Devolutions · Devolutions Server

Jico · Published 2023-04-21 · Updated 2023-04-29 · CVE-2023-2118

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2023.1.5.0 and below

Description The issue is related to insufficient access control in the support ticket feature, allowing an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.

Recommendations For Devolutions Server versions 2023.1.5.0 and below, consider restricting access to the support ticket feature until a fix is available. As a temporary workaround, limit the ability to send support tickets and download diagnostic files to authorized personnel only. Avoid using the vulnerable support ticket feature in Devolutions Server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-2118

Affected Products

Devolutions Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-2118 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2118 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2023-0010 · Vendor Advisory
• https://t.me/cvenotify/48872 · Telegram Post
• https://t.me/cvenotify/49413 · Telegram Post