CVEvulnerability

CVE-2025-4316

4.3 MEDIUM Published 2025-05-05 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-284

Description

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up to 2024.3.15.0.

Affected configurations

• devolutions devolutions server (< 2024.3.17.0) • devolutions devolutions server (>= 2025.1.3.0 < 2025.1.7.0)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References