{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-1939", "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", "state": "PUBLISHED", "assignerShortName": "DEVOLUTIONS", "dateReserved": "2023-04-07T13:39:45.374Z", "datePublished": "2023-04-11T17:47:49.976Z", "dateUpdated": "2023-04-11T17:47:49.976Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Remote Desktop Manager", "vendor": "Devolutions", "versions": [{"lessThan": "2022.3.34.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Remote Desktop Manager", "vendor": "Devolutions", "versions": [{"lessThan": "2022.3.2.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2023-04-11T14:18:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "No access control for the OTP key&nbsp;\n\n<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;on OTP entries</span>\n\n in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface."}], "value": "No access control for the OTP key\u00a0\n\n\u00a0on OTP entries\n\n in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface."}], "providerMetadata": {"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", "shortName": "DEVOLUTIONS", "dateUpdated": "2023-04-11T17:47:49.976Z"}, "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2023-0009"}], "source": {"discovery": "UNKNOWN"}, "title": "No access control for the OTP key on OTP entries", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:linux:*:*", "matchCriteriaId": "4F3171EE-56B5-4A43-AC2A-5B240D2510FC", "versionEndIncluding": "2022.3.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:windows:*:*", "matchCriteriaId": "E03C94F7-13B7-437F-9C4D-0FE41B267CDF", "versionEndIncluding": "2022.3.33.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "No access control for the OTP key\u00a0\n\n\u00a0on OTP entries\n\n in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface."}], "id": "CVE-2023-1939", "lastModified": "2023-04-21T17:59:36.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-11T18:15:58.447", "references": [{"source": "security@devolutions.net", "tags": ["Vendor Advisory"], "url": "https://devolutions.net/security/advisories/DEVO-2023-0009"}], "sourceIdentifier": "security@devolutions.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}