CVE-2025-3517 - AskarLabs CVE Database

CVE-2025-3517

Vendor Devolutions

Product Devolutions Server

Weakness CWE-266

Published May 1, 2025

Last update May 2, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.

Key dates

02Disclosure timeline

May 1, 2025 CVE published

May 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-3517 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html

Related vulnerabilities

04Related CVE

CVE-2026-0871 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators CVE-2025-2179 GlobalProtect App: Non Admin User Can Disable the GlobalProtect App CVE-2024-57967 CVE-2024-25633 In eLabFTW, if administrators can create users, users can too CVE-2024-56071 WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability