CVE-2023-1939

MEDIUM

Drevolutions Remote Desktop Manager <2022.3.33.0 - Info Disclosure

Title source: llm

Description

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

References (1)

Core 1

Core References

Vendor Advisory

https://devolutions.net/security/advisories/DEVO-2023-0009

Scores

CVSS v3 4.3

EPSS 0.0016

EPSS Percentile 36.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-732

Status published

Products (2)

devolutions/remote_desktop_manager < 2022.3.2.0

devolutions/remote_desktop_manager < 2022.3.33.0

Published Apr 11, 2023

Tracked Since Feb 18, 2026