Vulnerability · Published Apr 11, 2023 · Assigned by DEVOLUTIONS
CVE-2023-1939No access control for the OTP key on OTP entries
Medium 4.3
In plain English
A medium-severity incorrect permission assignment in Remote Desktop Manager from Devolutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 65.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Remote Desktop Manager | 0 – before 2022.3.34.0 |
| Devolutions | Remote Desktop Manager | 0 – before 2022.3.2.1 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N