CVE-2023-1202

Published: Apr 2, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with restricted rights to bypass entry permission via id collision.

Affected (1)

Products: Devolutions: Remote Desktop Manager

Devolutions

1 product

Remote Desktop Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Devolutions Remote Desktop Manager	Before 2023.1.10

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://devolutions.net/security/advisories/DEVO-2023-0008

Source: security@devolutions.net

Vendor Advisory

https://devolutions.net/security/advisories/DEVO-2023-0008

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.