CVE-2024-1900

EPSS 0.23%
Veröffentlicht 05.03.2024 22:15:47
Zuletzt bearbeitet 28.03.2025 16:21:15
Quelle security@devolutions.net
CVE-Watchlists
Login
Unerledigt
Login

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. 

The user will stay authenticated until the Devolutions Server token expiration.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Devolutions ≫ Devolutions Server Version <= 2023.3.16.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.23%	0.133

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.5	2.1	3.4	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://devolutions.net/security/advisories/DEVO-2024-0002

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-1900

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-1900

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-1900

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2024-1900