CVE-2024-3545

Published: Apr 9, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 0.9 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a computer where the software is installed even though the offline mode is disabled.

Affected (3)

Products: Devolutions: Devolutions Server, Remote Desktop Manager

Devolutions

2 products

Devolutions Server

Remote Desktop Manager

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	Before 2024.1.9.0
Devolutions Remote Desktop Manager	Before 2024.1.21.0
Devolutions Remote Desktop Manager	Before 2024.1.21.0

Related CWEs

CWE-281

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (2)

https://devolutions.net/security/advisories/DEVO-2024-0006

Source: security@devolutions.net

Vendor Advisory

https://devolutions.net/security/advisories/DEVO-2024-0006

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.