CVE-2022-3781

Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions Server 2022.3.1 and prior versions.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2022-0009	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:devolutions:devolutions_server::::::::
	cpe:2.3:a:devolutions:remote_desktop_manager::::::::

History

21 Jul 2023, 20:19

Type	Values Removed	Values Added
CWE	~~CWE-311~~	CWE-522

03 Nov 2022, 17:18

Type	Values Removed	Values Added
CWE		CWE-311
References	~~(MISC) https://devolutions.net/security/advisories/DEVO-2022-0009 -~~	(MISC) https://devolutions.net/security/advisories/DEVO-2022-0009 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:a:devolutions:remote_desktop_manager:::::::: cpe:2.3:a:devolutions:devolutions_server::::::::

01 Nov 2022, 19:40

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-01 19:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-3781

Mitre link : CVE-2022-3781

CVE.ORG link : CVE-2022-3781

JSON object : View

Products Affected

devolutions

devolutions_server
remote_desktop_manager

CWE

CWE-522

Insufficiently Protected Credentials

CWE-311

Missing Encryption of Sensitive Data

{"id": "CVE-2022-3781", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-11-01T19:15:11.150", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2022-0009", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "Dashlane password and Keepass Server password in My Account Settings\u00a0 are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data.\n\nThis issue affects : \nRemote Desktop Manager 2022.2.26 and prior versions.\n\nDevolutions Server 2022.3.1 and prior versions.\n\n\n"}, {"lang": "es", "value": "La contrase\u00f1a de Dashlane y la contrase\u00f1a del Keepass Server en My Account Settings no est\u00e1n cifradas en la base de datos en Devolutions Remote Desktop Manager 2022.2.26 y versiones anteriores y en Devolutions Server 2022.3.1 y versiones anteriores, lo que permite a los usuarios de la base de datos leer los datos. Este problema afecta a: Remote Desktop Manager 2022.2.26 y versiones anteriores. Devolutions Server 2022.3.1 y versiones anteriores."}], "lastModified": "2023-11-07T03:51:47.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D00735D4-E5F0-419E-AB94-7066ECCB3BD0", "versionEndExcluding": "2022.3.2"}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEE5E4C6-72AE-4E2E-818A-1A7C6D77FCCE", "versionEndExcluding": "2022.2.27"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}