CVE-2023-1939

Published: Apr 11, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

Affected (2)

Products: Devolutions: Remote Desktop Manager

1 product

Remote Desktop Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Devolutions Remote Desktop Manager	Up to 2022.3.2.0
Devolutions Remote Desktop Manager	Up to 2022.3.33.0

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://devolutions.net/security/advisories/DEVO-2023-0009

Source: security@devolutions.net

Vendor Advisory

https://devolutions.net/security/advisories/DEVO-2023-0009

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.