CVE-2023-2257
Last modified
CVE-2023-2257 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space. . EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Workspace | < 2023.1.1.4 |
References
- https://devolutions.net/security/advisories/DEVO-2023-0011Vendor Advisory
- https://devolutions.net/security/advisories/DEVO-2023-0011Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-2257?
How severe is CVE-2023-2257?
How do I fix CVE-2023-2257?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-22527A template injection vulnerability on older versions of Conf…9.8
- CVE-2023-2253A flaw was found in the `/v2/_catalog` endpoint in distribut…6.5
- CVE-2023-2254The Ko-fi Button WordPress plugin before 1.3.3 does not prop…4.8
- CVE-2023-2255Improper access control in editor components of The Document…5.3
- CVE-2023-22551The FTP (aka "Implementation of a simple FTP client and serv…7.5
- CVE-2023-2256The Product Addons & Fields for WooCommerce WordPress plugin…6.1
- CVE-2023-22572 Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion …7.8
- CVE-2023-22573Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion o…5.5
- CVE-2023-22574 Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertio…8.1
- CVE-2023-22575Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion…8.8
- CVE-2023-22576Dell Repository Manager version 3.4.2 and earlier, contain a…7.8
- CVE-2023-22577Within White Rabbit Switch it's possible as an unauthenticat…7.5
Are you affected by CVE-2023-2257?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST