CVE-2023-4417
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Devolutions Remote Desktop Manager version 2023.2.19 and earlier, improper access controls in the entry duplication component allow an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, potentially leading to a loss of confidentiality. Accidental sharing of personal data may also put users at risk.
Recommendation
It is recommended to update Devolutions Remote Desktop Manager to the latest version to mitigate this vulnerability. Additionally, conducting an access audit of vaults is advisable to ensure no unauthorized data sharing has occurred.
Original NVD description (English source)
Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.