CVE-2024-4846

{"id": "CVE-2024-4846", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-06-25T13:15:50.120", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2024-0009", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}, {"url": "https://devolutions.net/security/advisories/DEVO-2024-0009", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab."}, {"lang": "es", "value": "La omisi\u00f3n de autenticaci\u00f3n en la funci\u00f3n 2FA en Devolutions Server 2024.1.14.0 y versiones anteriores permite a un atacante autenticado autenticarse ante otro usuario sin que se le solicite la 2FA a trav\u00e9s de otra pesta\u00f1a del navegador."}], "lastModified": "2025-03-28T16:22:26.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5ED1D6E-CB0B-42BD-8580-A3C7F55F5499", "versionEndExcluding": "2024.1.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}