CVE-2024-11670

MEDIUM

Drevolutions Remote Desktop Manager <2024.2.21 - Auth Bypass

Title source: llm
STIX 2.1

Description

Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via specific actions.

References (1)

Core 1
Core References

Scores

CVSS v3 5.4
EPSS 0.0064
EPSS Percentile 45.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
devolutions/remote_desktop_manager < 2024.3.10.0 (2 CPE variants)
Published Nov 25, 2024
Tracked Since Feb 18, 2026