PT-2023-32850 · Devolutions · Devolutions Remote Desktop Manager

Published 2023-12-21 · Updated 2024-10-29 · CVE-2023-7047

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions 2023.3.31 and earlier

Description The issue is related to inadequate validation of permissions when using remote tools and macros via the context menu. This allows a user to initiate a connection without proper execution rights via the remote tools feature, affecting only SQL data sources.

Recommendations For Devolutions Remote Desktop Manager versions 2023.3.31 and earlier, consider disabling the remote tools feature until a patch is available to prevent exploitation. Restrict access to the context menu to minimize the risk of unauthorized connections. Avoid using the remote tools feature for SQL data sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-7047

Affected Products

Devolutions Remote Desktop Manager

References · 7

• https://osv.dev/vulnerability/CVE-2023-7047 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2023-0024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7047 · Security Note
• https://twitter.com/RedPacketSec/status/1738500698134675629 · Twitter Post
• https://twitter.com/CVEnew/status/1737848484890554525 · Twitter Post
• https://t.me/cvenotify/99901 · Telegram Post
• https://t.me/cvenotify/66236 · Telegram Post