5.9

CVE-2025-8353

UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Devolutions ≫ Devolutions Server Version < 2025.2.5.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.332
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 5.9 1.6 4.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
CWE-446 UI Discrepancy for Security Feature

The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

https://devolutions.net/security/advisories/DEVO-2025-0013/
Vendor Advisory