CVE-2024-4846

published 2024-06-25

CVE-2024-4846: Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without…

Priority P3 41 medium 6.3 CVSS 3.1

AV N AC L PR L UI N S U C L I L A L

Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
devolutions	devolutions_server	< 2024.1.15.0	2024.1.15.0
devolutions	server	<= 2024.1.14.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-290