CVE-2024-4846

State: Published
Severity: 6.3 Medium
Published: Jun 25, 2024
Updated: Nov 20, 2024
Reserved: May 13, 2024

Description

Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	CISA-ADP

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
ServerDevolutions	2024.1.14.0 and earlierAffected

References

https://devolutions.net/security/advisories/DEVO-2024-0009

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.