CVE-2023-6588 : Offline mode is always enabled, even if permission disallows it, in Devolutions

Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline.

Published 2023-12-07 16:15:08

Updated 2023-12-12 18:50:19

Source Devolutions Inc.

View at NVD, CVE.org

Products affected by CVE-2023-6588

Devolutions » Workspace »
Versions up to, including, (<=) 2023.3.2.0
cpe:2.3:a:devolutions:workspace:*:*:*:*:-:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-6588

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-6588

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2023-6588

https://devolutions.net/security/advisories/DEVO-2023-0022/

Devolutions
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-6588

Products affected by CVE-2023-6588

Exploit prediction scoring system (EPSS) score for CVE-2023-6588

CVSS scores for CVE-2023-6588

References for CVE-2023-6588