CVE-2023-2282

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Devolutions	Remote Desktop Manager	<= 2023.1.22

References

https://devolutions.net/security/advisories/DEVO-2023-0012Vendor Advisory
https://devolutions.net/security/advisories/DEVO-2023-0012Vendor Advisory

Timeline

Published: Apr 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-22836.5A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signatur CVE-2023-228327.5The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configuratio CVE-2023-228336.5Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users withi CVE-2023-228344.3The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to cl CVE-2023-228357.7A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in CVE-2023-228365.4In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, th CVE-2023-228385.4Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1,CVE-2023-228397.5On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x CVE-2023-22844.3The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2023-228405.5Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentiall CVE-2023-228417.3Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(CVE-2023-228427.5On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is