CVE-2022-3781 - OpenCVE

Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions Server 2022.3.1 and prior versions.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Devolutions	Remote Desktop Manager Devolutions Server

Configuration 1 [-]

OR	cpe:2.3:a:devolutions:devolutions_server::::::::
	cpe:2.3:a:devolutions:remote_desktop_manager::::::::

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2022-0009	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: DEVOLUTIONS

Published: 2022-11-01T18:28:28.590Z

Updated:

Reserved: 2022-10-31T19:43:01.182Z

Link: CVE-2022-3781

JSON object: View

NVD Information

Status : Modified

Published: 2022-11-01T19:15:11.150

Modified: 2023-11-07T03:51:47.720

Link: CVE-2022-3781

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "D00735D4-E5F0-419E-AB94-7066ECCB3BD0", "versionEndExcluding": "2022.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEE5E4C6-72AE-4E2E-818A-1A7C6D77FCCE", "versionEndExcluding": "2022.2.27", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Dashlane password and Keepass Server password in My Account Settings\u00a0 are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data.\n\nThis issue affects : \nRemote Desktop Manager 2022.2.26 and prior versions.\n\nDevolutions Server 2022.3.1 and prior versions.\n\n\n"}, {"lang": "es", "value": "La contrase\u00f1a de Dashlane y la contrase\u00f1a del Keepass Server en My Account Settings no est\u00e1n cifradas en la base de datos en Devolutions Remote Desktop Manager 2022.2.26 y versiones anteriores y en Devolutions Server 2022.3.1 y versiones anteriores, lo que permite a los usuarios de la base de datos leer los datos. Este problema afecta a: Remote Desktop Manager 2022.2.26 y versiones anteriores. Devolutions Server 2022.3.1 y versiones anteriores."}], "id": "CVE-2022-3781", "lastModified": "2023-11-07T03:51:47.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-11-01T19:15:11.150", "references": [{"source": "security@devolutions.net", "tags": ["Vendor Advisory"], "url": "https://devolutions.net/security/advisories/DEVO-2022-0009"}], "sourceIdentifier": "security@devolutions.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-311"}], "source": "security@devolutions.net", "type": "Secondary"}]}