GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-6593 (GCVE-0-2023-6593)

Vulnerability from cvelistv5 – Published: 2023-12-12 14:32 – Updated: 2024-08-28 14:52
VLAI
Summary
Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-28 14:47 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Devolutions Remote Desktop Manager Affected: 0 , ≤ 2023.3.4.0 (custom)
guessed Create a notification for this product.
devolutions remote_desktop_manager Affected: 0 , ≤ 2023.3.4.0 (custom)
    cpe:2.3:a:devolutions:remote_desktop_manager:-:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:14.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://devolutions.net/security/advisories/DEVO-2023-0023/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:devolutions:remote_desktop_manager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "remote_desktop_manager",
            "vendor": "devolutions",
            "versions": [
              {
                "lessThanOrEqual": "2023.3.4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-28T14:47:53.634630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T14:52:06.753Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Permission",
            "SQL Data Source"
          ],
          "platforms": [
            "iOS"
          ],
          "product": "Remote Desktop Manager",
          "vendor": "Devolutions",
          "versions": [
            {
              "lessThanOrEqual": "2023.3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "\n\nClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.\n\n\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-12T14:32:56.806Z",
        "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
        "shortName": "DEVOLUTIONS"
      },
      "references": [
        {
          "url": "https://devolutions.net/security/advisories/DEVO-2023-0023/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
    "assignerShortName": "DEVOLUTIONS",
    "cveId": "CVE-2023-6593",
    "datePublished": "2023-12-12T14:32:56.806Z",
    "dateReserved": "2023-12-07T19:16:24.562Z",
    "dateUpdated": "2024-08-28T14:52:06.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-6593",
      "date": "2026-09-16",
      "epss": "0.00725",
      "percentile": "0.52347"
    },
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2023.3.5.0\", \"matchCriteriaId\": \"5AC0A6D1-2E97-4056-BE62-2A7021CAC3BA\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B5415705-33E5-46D5-8E4D-9EBADC8C5705\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\n\\nClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"La omisi\\u00f3n de permisos del lado del cliente en Devolutions Remote Desktop Manager 2023.3.4.0 y versiones anteriores en iOS permite a un atacante que tiene acceso a la aplicaci\\u00f3n ejecutar entradas en una fuente de datos SQL sin restricciones.\"}]",
      "id": "CVE-2023-6593",
      "lastModified": "2024-11-21T08:44:09.953",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2023-12-12T15:15:07.920",
      "references": "[{\"url\": \"https://devolutions.net/security/advisories/DEVO-2023-0023/\", \"source\": \"security@devolutions.net\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://devolutions.net/security/advisories/DEVO-2023-0023/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@devolutions.net",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-732\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-6593\",\"sourceIdentifier\":\"security@devolutions.net\",\"published\":\"2023-12-12T15:15:07.920\",\"lastModified\":\"2026-06-17T06:51:03.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\n\\nClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.\\n\\n\\n\"},{\"lang\":\"es\",\"value\":\"La omisi\u00f3n de permisos del lado del cliente en Devolutions Remote Desktop Manager 2023.3.4.0 y versiones anteriores en iOS permite a un atacante que tiene acceso a la aplicaci\u00f3n ejecutar entradas en una fuente de datos SQL sin restricciones.\"}],\"affected\":[{\"source\":\"security@devolutions.net\",\"affectedData\":[{\"vendor\":\"Devolutions\",\"product\":\"Remote Desktop Manager\",\"defaultStatus\":\"unaffected\",\"modules\":[\"Permission\",\"SQL Data Source\"],\"platforms\":[\"iOS\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2023.3.4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"devolutions\",\"product\":\"remote_desktop_manager\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:devolutions:remote_desktop_manager:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2023.3.4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-28T14:47:53.634630Z\",\"id\":\"CVE-2023-6593\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2023.3.5.0\",\"matchCriteriaId\":\"5AC0A6D1-2E97-4056-BE62-2A7021CAC3BA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5415705-33E5-46D5-8E4D-9EBADC8C5705\"}]}]}],\"references\":[{\"url\":\"https://devolutions.net/security/advisories/DEVO-2023-0023/\",\"source\":\"security@devolutions.net\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://devolutions.net/security/advisories/DEVO-2023-0023/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T00:37:01+00:00",
      "cve": "CVE-2023-6593",
      "id": "CVE-2023-6593",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2023-6593",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-6593.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://devolutions.net/security/advisories/DEVO-2023-0023/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T08:35:14.865Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-6593\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-28T14:47:53.634630Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:devolutions:remote_desktop_manager:-:*:*:*:*:*:*:*\"], \"vendor\": \"devolutions\", \"product\": \"remote_desktop_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2023.3.4.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T14:51:59.530Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Devolutions\", \"modules\": [\"Permission\", \"SQL Data Source\"], \"product\": \"Remote Desktop Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2023.3.4.0\"}], \"platforms\": [\"iOS\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://devolutions.net/security/advisories/DEVO-2023-0023/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"\\n\\nClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.\u003cbr\u003e\u003c/div\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"bfee16bd-18e6-446c-9a65-f5b2e3d89c23\", \"shortName\": \"DEVOLUTIONS\", \"dateUpdated\": \"2023-12-12T14:32:56.806Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-6593\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-28T14:52:06.753Z\", \"dateReserved\": \"2023-12-07T19:16:24.562Z\", \"assignerOrgId\": \"bfee16bd-18e6-446c-9a65-f5b2e3d89c23\", \"datePublished\": \"2023-12-12T14:32:56.806Z\", \"assignerShortName\": \"DEVOLUTIONS\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.