Devolutions: >> Devolutions Server >> 2023.3.13.0 Security Vulnerabilities
Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365.
The user will stay authenticated until the Devolutions Server token expiration.
CVSS Score
5.5
EPSS Score
0.002
Published
2024-03-05
Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable.
CVSS Score
4.3
EPSS Score
0.003
Published
2024-03-05
Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated privilege even after the expiration under specific circumstances
CVSS Score
7.6
EPSS Score
0.004
Published
2024-03-05
Page 9