CVE-2025-6741 | THREATINT

Description

Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.4.0 * Devolutions Server 2025.1.11.0 and earlier

PUBLISHED Reserved 2025-06-26 | Published 2025-07-22 | Updated 2025-11-25 | Assigner DEVOLUTIONS

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-284: Improper Access Control

Product status

Default status

unaffected

Any version

affected

2025.2.2.0 (custom)

affected

Credits

Gino Boudreau (mononclemich) finder

References

devolutions.net/security/advisories/DEVO-2025-0012/

cve.org (CVE-2025-6741)

nvd.nist.gov (CVE-2025-6741)

Download JSON