CVE-2024-2918

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2918

3.6 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

I

mproper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request.

References
Link Resource
https://devolutions.net/security/advisories/DEVO-2024-0006 Vendor Advisory
https://devolutions.net/security/advisories/DEVO-2024-0006 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
History

28 Mar 2025, 16:20

Type Values Removed Values Added
First Time Devolutions
Devolutions devolutions Server
CPE cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
References () https://devolutions.net/security/advisories/DEVO-2024-0006 - () https://devolutions.net/security/advisories/DEVO-2024-0006 - Vendor Advisory
CWE NVD-CWE-noinfo

21 Nov 2024, 09:10

Type Values Removed Values Added
References () https://devolutions.net/security/advisories/DEVO-2024-0006 - () https://devolutions.net/security/advisories/DEVO-2024-0006 -

07 Nov 2024, 00:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.6
Information

Published : 2024-04-09 19:15

Updated : 2025-03-28 16:20

NVD link : CVE-2024-2918

Mitre link : CVE-2024-2918

CVE.ORG link : CVE-2024-2918

JSON object : View

Products Affected

devolutions

CWE
NVD-CWE-noinfo