{"id":"CVE-2025-1636","state":"PUBLISHED","title":"Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticat","description":"Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.","publishedAt":"2025-03-13T12:47:13.034Z","updatedAt":"2025-03-18T16:20:55.598Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions Remote Desktop Manager"],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.29.0","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://devolutions.net/security/advisories/DEVO-2025-0004/"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1636.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1636","state":"PUBLISHED","datePublished":"2025-03-13T12:47:13.034Z","dateUpdated":"2025-03-18T16:20:55.598Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2025-02-24T16:29:56.376Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic."}],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.29.0","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2025-0004/"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2025-03-13T17:28:45.691Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-03-18T16:20:46.578469Z","id":"CVE-2025-1636","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-18T16:20:55.598Z"}}]}}}