CVE-2025-4433

HIGH

8.8

Descricao

Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado5/30/2025

Ultima modificacao11/25/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

devolutions:devolutions_server

Fraquezas (CWE)

CWE-284

Referencias

https://devolutions.net/security/advisories/DEVO-2025-0010/(security@devolutions.net)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.