CVE-2024-6512

Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2024-0013	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

History

01 Oct 2024, 16:36

Type	Values Removed	Values Added
First Time		Devolutions Devolutions devolutions Server
CPE		cpe:2.3:a:devolutions:devolutions_server::::::::
References	~~() https://devolutions.net/security/advisories/DEVO-2024-0013 -~~	() https://devolutions.net/security/advisories/DEVO-2024-0013 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5

26 Sep 2024, 13:32

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-25 14:15

Updated : 2025-03-14 16:15

NVD link : CVE-2024-6512

Mitre link : CVE-2024-6512

CVE.ORG link : CVE-2024-6512

JSON object : View

Products Affected

devolutions

devolutions_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-6512", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-09-25T14:15:05.560", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2024-0013", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Authorization bypass in the\u00a0PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism."}, {"lang": "es", "value": "La omisi\u00f3n de autorizaci\u00f3n en el mecanismo de aprobaci\u00f3n de solicitud de acceso PAM en Devolutions Server 2024.2.10 y versiones anteriores permite a los usuarios autenticados con permisos aprobar sus propias solicitudes, omitiendo las restricciones de seguridad previstas, a trav\u00e9s del mecanismo de aprobaci\u00f3n de solicitud de acceso PAM."}], "lastModified": "2025-03-14T16:15:38.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52B27A2F-9360-4F61-9857-59157AF84556", "versionEndExcluding": "2024.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}