{"id":"CVE-2024-6354","state":"PUBLISHED","title":"Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via th","description":"Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.","publishedAt":"2024-06-26T16:20:42.264Z","updatedAt":"2025-03-13T18:28:31.840Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions Remote Desktop Manager"],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.2.11","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://devolutions.net/security/advisories/DEVO-2024-0010"],"weaknesses":["CWE-1262"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6354.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6354","state":"PUBLISHED","datePublished":"2024-06-26T16:20:42.264Z","dateUpdated":"2025-03-13T18:28:31.840Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2024-06-26T16:15:40.371Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard."}],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.2.11","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2024-0010"}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2024-06-26T16:20:42.264Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"devolutions","product":"remote_desktop_manager","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.2.11","versionType":"custom"}],"cpes":["cpe:2.3:a:devolutions:remote_desktop_manager:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-26T23:09:12.417026Z","id":"CVE-2024-6354","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1262","type":"CWE","lang":"en","description":"CWE-1262 Improper Access Control for Register Interface"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-13T18:28:31.840Z"}},{"title":"CVE Program Container","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2024-0010","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:33:05.392Z"}}]}}}