7.7

CVE-2025-6741

Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature


This issue affects the following versions :

  *  Devolutions Server 2025.2.2.0 through 2025.2.4.0
  *  
Devolutions Server 2025.1.11.0 and earlier
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Devolutions ≫ Devolutions Server Version <= 2025.1.11.0
Devolutions ≫ Devolutions Server Version >= 2025.2.2.0 < 2025.2.5.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.132
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@devolutions.net 7.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.