{"id":"CVE-2023-1939","state":"PUBLISHED","title":"No access control for the OTP key on OTP entries","description":"No access control for the OTP key \n\n on OTP entries\n\n in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.","publishedAt":"2023-04-11T17:47:49.976Z","updatedAt":"2025-02-10T18:57:15.161Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions Remote Desktop Manager"],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2022.3.34.0","versionType":"custom"}],"platforms":["Windows"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2022.3.2.1","versionType":"custom"}],"platforms":["Linux"]}],"references":["https://devolutions.net/security/advisories/DEVO-2023-0009"],"weaknesses":["CWE-732"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/1xxx/CVE-2023-1939.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-1939","state":"PUBLISHED","datePublished":"2023-04-11T17:47:49.976Z","dateUpdated":"2025-02-10T18:57:15.161Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2023-04-07T13:39:45.374Z"},"containers":{"cna":{"title":"No access control for the OTP key on OTP entries","descriptions":[{"lang":"en","value":"No access control for the OTP key \n\n on OTP entries\n\n in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface."}],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2022.3.34.0","versionType":"custom"}],"platforms":["Windows"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2022.3.2.1","versionType":"custom"}],"platforms":["Linux"]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2023-0009"}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2023-04-11T17:47:49.976Z"},"datePublic":"2023-04-11T14:18:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2023-0009","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:05:27.088Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-02-10T18:56:59.479525Z","id":"CVE-2023-1939","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-732","type":"CWE","lang":"en","description":"CWE-732 Incorrect Permission Assignment for Critical Resource"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-10T18:57:15.161Z"}}]}}}