CVE-2024-11672

Published: Nov 25, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.

Affected (2)

Products: Devolutions: Remote Desktop Manager

Devolutions

1 product

Remote Desktop Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Devolutions Remote Desktop Manager	Before 2024.3.10.0
Devolutions Remote Desktop Manager	Before 2024.3.10.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://devolutions.net/security/advisories/DEVO-2024-0016

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.