CVE-2024-2918

LowCVSS 3.6/10Last modified Jun 17, 2026

Description

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-291807.5Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL CVE-2024-291813.5Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the coll CVE-2024-291826.1Collabora Online is a collaborative online office suite based on LibreOffice. A stored cross-site scripting vulnerability was found in Colla CVE-2024-291836.1OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a re CVE-2024-291848.0FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Si CVE-2024-291859.0FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/too CVE-2024-291865.3Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used wit CVE-2024-291877.3WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Bur CVE-2024-291887.9WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `Remove CVE-2024-291897.8PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/con CVE-2024-29195.4The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Cou CVE-2024-291907.5Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dyna