CVE-2025-3517

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3517
Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://devolutions.net/security/advisories/DEVO-2025-0006/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
History

17 Jun 2025, 14:18

Type Values Removed Values Added
CPE cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
References () https://devolutions.net/security/advisories/DEVO-2025-0006/ - () https://devolutions.net/security/advisories/DEVO-2025-0006/ - Vendor Advisory
First Time Devolutions
Devolutions devolutions Server

02 May 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) El error de cambio de contexto de privilegio en la función PAM JIT en Devolutions Server 2025.1.5.0 y versiones anteriores permite que una contraseña de cuenta PAM JIT se restablezca incorrectamente después del uso a través de acciones específicas, como editar el nombre de usuario.
Summary (en) Privilege context switching error in PAM JIT feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM JIT account password to be improperly reset after usage via specific actions such as editing the username. (en) Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.
CWE CWE-270 CWE-266

01 May 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 19:15

Updated : 2025-06-17 14:18

NVD link : CVE-2025-3517

Mitre link : CVE-2025-3517

CVE.ORG link : CVE-2025-3517

JSON object : View

Products Affected

devolutions

  • devolutions_server
CWE
CWE-266

Incorrect Privilege Assignment