CVE-2023-2257

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature.

This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-225727.8Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A lo CVE-2023-225735.5Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileg CVE-2023-225748.1Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI mo CVE-2023-225758.8Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges CVE-2023-225767.8Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low pr CVE-2023-225777.5Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP c CVE-2023-225789.8Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.CVE-2023-225798.8Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.CVE-2023-22588.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-225807.5Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.CVE-2023-225819.8White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web CVE-2023-225826.1The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.