Skip to main content

Remote Desktop Manager CVE-2023-1939

MEDIUM
Incorrect Permission Assignment for Critical Resource (CWE-732)
2023-04-11 security@devolutions.net
Information Disclosure Microsoft Remote Desktop Manager
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Apr 11, 2023 - 18:15 nvd
MEDIUM 4.3

DescriptionNVD

No access control for the OTP key

on OTP entries

in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

AnalysisAI

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface. Affected products include: Devolutions Remote Desktop Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.

More in Remote Desktop Manager

View all
CVE-2024-6057 CRITICAL
9.8 Jun 17

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allo
CVE-2023-6593 CRITICAL
9.8 Dec 12

Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker tha
CVE-2023-5766 CRITICAL
9.8 Nov 01

A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to r
CVE-2023-5765 CRITICAL
9.8 Nov 01

Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on

CVE-2023-4373 CRITICAL
9.8 Aug 21

Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager ve
CVE-2024-11621 HIGH
8.8 Feb 10

Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to
CVE-2026-12161 HIGH
8.8 Jun 15

OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authe
CVE-2022-4287 HIGH
8.8 Dec 21

Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on W
CVE-2022-3641 HIGH
8.8 Dec 12

Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows

CVE-2021-42098 HIGH
8.8 Oct 18

An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to byp
CVE-2025-1193 HIGH
8.1 Feb 10

Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and

CVE-2024-12149 HIGH
8.1 Dec 04

Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-1939 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy