{"id":"CVE-2023-1202","state":"PUBLISHED","title":"Permission bypass when importing or synchronizing entries in User vault","description":"Permission bypass when importing or synchronizing entries in User vault\n\n in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with restricted rights to bypass entry permission via id collision.","publishedAt":"2023-03-23T17:12:47.824Z","updatedAt":"2025-02-20T20:54:27.768Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions Remote Desktop Manager"],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2023.1.9","versionType":"custom"}]}],"references":["https://devolutions.net/security/advisories/DEVO-2023-0008"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/1xxx/CVE-2023-1202.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-1202","state":"PUBLISHED","datePublished":"2023-03-23T17:12:47.824Z","dateUpdated":"2025-02-20T20:54:27.768Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2023-03-06T15:52:04.023Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Permission bypass when importing or synchronizing entries in User vault\n\n in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with restricted rights to bypass entry permission via id collision."}],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2023.1.9","versionType":"custom"}]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2023-0008"}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2023-04-02T18:49:20.069Z"},"datePublic":"2023-03-23T17:12:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2023-0008","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T05:40:58.190Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-02-20T20:50:30.931746Z","id":"CVE-2023-1202","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"CWE-863 Incorrect Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-20T20:54:27.768Z"}}]}}}