Vulnerability · Published Feb 11, 2025 · Assigned by DEVOLUTIONS
CVE-2025-1231
Medium 5.4
In plain English
A medium-severity improper authentication in Server from Devolutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Server | 0 – through 2024.3.10.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N