2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Server","vendor":"Devolutions","versions":[{"lessThanOrEqual":"2026.1.16.0","status":"affected","version":"2026.1.6.0","versionType":"custom"},{"lessThanOrEqual":"2025.3.20.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@devolutions.net"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*","matchCriteriaId":"6E689234-ABCB-49B5-AD17-00C2E2FC3B11","versionEndExcluding":"2025.3.22.0","vulnerable":true},{"criteria":"cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*","matchCriteriaId":"02811CA7-5B80-47D7-B826-18B3CB1213E9","versionEndExcluding":"2026.1.19.0","versionStartIncluding":"2026.1.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request.\n\nThis issue affects :\n\n * Devolutions Server 2026.1.6.0 through 2026.1.16.0\n * Devolutions Server 2025.3.20.0 and earlier"},{"lang":"es","value":"Control de acceso inadecuado en la función de registro de actividad de entrada en Devolutions Server permite a un usuario autenticado con acceso a una entrada pero sin el permiso requerido recuperar los registros de actividad de esa entrada a través de una solicitud de API manipulada.\n\nEste problema afecta a :\n\n * Devolutions Server 2026.1.6.0 hasta 2026.1.16.0\n * Devolutions Server 2025.3.20.0 y versiones anteriores"}],"id":"CVE-2026-5171","lastModified":"2026-07-23T16:10:00.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-22T16:49:58.273868Z","version":"2.0.3"}}]},"published":"2026-05-22T16:16:21.103","references":[{"source":"security@devolutions.net","tags":["Vendor Advisory"],"url":"https://devolutions.net/security/advisories/DEVO-2026-0013/"}],"sourceIdentifier":"security@devolutions.net","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@devolutions.net","type":"Secondary"}]}
|