CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The user will stay authenticated until the Devolutions Server token expiration.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2024-0002	Vendor Advisory
https://devolutions.net/security/advisories/DEVO-2024-0002	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

History

28 Mar 2025, 16:21

Type	Values Removed	Values Added
References	~~() https://devolutions.net/security/advisories/DEVO-2024-0002 -~~	() https://devolutions.net/security/advisories/DEVO-2024-0002 - Vendor Advisory
CWE		CWE-613
First Time		Devolutions devolutions Server Devolutions
CPE		cpe:2.3:a:devolutions:devolutions_server::::::::

21 Nov 2024, 08:51

Type	Values Removed	Values Added
References	~~() https://devolutions.net/security/advisories/DEVO-2024-0002 -~~	() https://devolutions.net/security/advisories/DEVO-2024-0002 -

01 Nov 2024, 17:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5

06 Mar 2024, 15:18

Type	Values Removed	Values Added
Summary		(es) La gestión inadecuada de la sesión en el flujo de autenticación del proveedor de identidad en Devolutions Server 2023.3.14.0 y versiones anteriores permite que un usuario autenticado a través de un proveedor de identidad permanezca autenticado después de que su usuario se deshabilite o elimine en el proveedor de identidad, como Okta o Microsoft O365. El usuario permanecerá autenticado hasta que caduque el token del servidor Devolutions.

05 Mar 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-05 22:15

Updated : 2025-03-28 16:21

NVD link : CVE-2024-1900

Mitre link : CVE-2024-1900

CVE.ORG link : CVE-2024-1900

JSON object : View

Products Affected

devolutions

devolutions_server

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2024-1900", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.1}]}, "published": "2024-03-05T22:15:47.060", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2024-0002", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}, {"url": "https://devolutions.net/security/advisories/DEVO-2024-0002", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. \n\nThe user will stay authenticated until the Devolutions Server token expiration."}, {"lang": "es", "value": "La gesti\u00f3n inadecuada de la sesi\u00f3n en el flujo de autenticaci\u00f3n del proveedor de identidad en Devolutions Server 2023.3.14.0 y versiones anteriores permite que un usuario autenticado a trav\u00e9s de un proveedor de identidad permanezca autenticado despu\u00e9s de que su usuario se deshabilite o elimine en el proveedor de identidad, como Okta o Microsoft O365. El usuario permanecer\u00e1 autenticado hasta que caduque el token del servidor Devolutions."}], "lastModified": "2025-03-28T16:21:15.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "960AC5BA-C623-415A-967E-E6E8E5F3A17C", "versionEndIncluding": "2023.3.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}

5.5 /10