CVE-2023-1939

No access control for the OTP key on OTP entries

State: Published
Severity: 4.3 Medium
Published: Apr 11, 2023
Updated: Feb 10, 2025
Reserved: Apr 7, 2023

Description

No access control for the OTP key

on OTP entries

in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
Remote Desktop ManagerDevolutions	before 2022.3.34.0Affected
Remote Desktop ManagerDevolutions	before 2022.3.2.1Affected

References

https://devolutions.net/security/advisories/DEVO-2023-0009

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.