Description
No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- Devolutions / Remote Desktop Manager0 – 2022.3.34.0
- Devolutions / Remote Desktop Manager0 – 2022.3.2.1
References
- VENDOR_ADVISORYhttps://devolutions.net/security/advisories/DEVO-2023-0009