CVE-2024-11672

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Devolutions	Remote Desktop Manager	<= 2024.2.21.0

References

https://devolutions.net/security/advisories/DEVO-2024-0016Vendor Advisory

Timeline

Published: Nov 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-116734.3A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects so CVE-2024-116748.8A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of CVE-2024-116755.4A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is CVE-2024-116765.4A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown CVE-2024-116775.4A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part o CVE-2024-116785.4A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unkno CVE-2024-116794.4An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker CVE-2024-11685.4The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versio CVE-2024-116809.8ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit CVE-2024-116816.8A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against CVE-2024-116826.1The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to CVE-2024-116836.1The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_type' parameter in all vers