CVE-2025-1636

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1636
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://devolutions.net/security/advisories/DEVO-2025-0004/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:free:windows:*:*
cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:team:windows:*:*
History

28 Mar 2025, 16:20

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () https://devolutions.net/security/advisories/DEVO-2025-0004/ - () https://devolutions.net/security/advisories/DEVO-2025-0004/ - Vendor Advisory
First Time Devolutions remote Desktop Manager
Devolutions
CPE cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:team:windows:*:*
cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:free:windows:*:*

18 Mar 2025, 17:15

Type Values Removed Values Added
Summary
  • (es) La exposición de información confidencial en el componente de historial de contraseñas de mis credenciales personales en Devolutions Remote Desktop Manager 2024.3.29 y versiones anteriores en Windows permite que un usuario autenticado filtre inadvertidamente Mis credenciales personales en una bóveda compartida a través de la función de borrar historial debido a una lógica comercial defectuosa.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

13 Mar 2025, 18:15

Type Values Removed Values Added
Summary (en) Exposure of sensitive information in My Personnal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personnal Credentials in a shared vault via the clear history feature due to faulty business logic. (en) Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.

13 Mar 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-13 13:15

Updated : 2025-03-28 16:20

NVD link : CVE-2025-1636

Mitre link : CVE-2025-1636

CVE.ORG link : CVE-2025-1636

JSON object : View

Products Affected

devolutions

  • remote_desktop_manager
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo