Incorrect authorization in Devolutions Workspace Desktop
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Devolutions | Workspace Desktop | up to 2023.1.1.3 | — | No fix listed | CNA |
- Workspace Desktop VendorDevolutions Affected up to 2023.1.1.3 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:devolutions:workspace:*:*:*:*:desktop:*:*:* | before 2023.1.1.4 | Vulnerable | Devolutions |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:devolutions:workspace:*:*:*:*:desktop:*:*:* Versions before 2023.1.1.4 Vulnerable ·Devolutions
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2257
- 2026-10-03 Alias added: GHSA-2rx2-wvh6-wg6m
References
More Devolutions Workspace vulnerabilities
- TI-2023-06037 Offline mode is always enabled, even if permission disallows it, in Devolutions Server… CVSS 3.1MEDIUM 6.5
- TI-2024-02080 Improper access control in the user interface in Devolutions Workspace 2024.1.0 and… CVSS 3.1MEDIUM 6.3
Sources
- CVE-2023-2257 · CVE Program
- CVE-2023-2257 · NVD
- FIRST EPSS
- GHSA-2rx2-wvh6-wg6m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences