CVE-2023-4417
Last modified
CVE-2023-4417 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Remote Desktop Manager | <= 2023.2.19 |
References
- https://devolutions.net/security/advisories/DEVO-2023-0015Vendor Advisory
- https://devolutions.net/security/advisories/DEVO-2023-0015Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4417?
How severe is CVE-2023-4417?
How do I fix CVE-2023-4417?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-44164The 'Email' parameter of the process_login.php resource doe…9.8
- CVE-2023-44165Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-44166The 'age' parameter of the process_registration.php resource…9.8
- CVE-2023-44167Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-44168Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-44169SeaCMS V12.9 was discovered to contain an arbitrary file wri…9.8
- CVE-2023-44170SeaCMS V12.9 was discovered to contain an arbitrary file wri…9.8
- CVE-2023-44171SeaCMS V12.9 was discovered to contain an arbitrary file wri…9.8
- CVE-2023-44172SeaCMS V12.9 was discovered to contain an arbitrary file wri…9.8
- CVE-2023-44173Online Movie Ticket Booking System v1.0 is vulnerable to an…5.4
- CVE-2023-44174Online Movie Ticket Booking System v1.0 is vulnerable to an…5.4
- CVE-2023-44175 A Reachable Assertion vulnerability in the routing protocol…7.5
Are you affected by CVE-2023-4417?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST