CVE-2025-4316

published 2025-05-05

CVE-2025-4316: Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy…

Priority P4 20 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C L I N A N

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions.

This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up to 2024.3.15.0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
devolutions	devolutions_server	< 2024.3.17.0	2024.3.17.0
devolutions	devolutions_server	>= 2025.1.3.0 < 2025.1.7.0	2025.1.7.0
devolutions	server	<= 2024.3.15.0	—
devolutions	server	2025.1.3.0 – 2025.1.6.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284