CVE-2025-4316 - AskarLabs CVE Database

CVE-2025-4316

Vendor Devolutions

Product Server

Weakness CWE-284

Published May 5, 2025

Last update May 14, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up to 2024.3.15.0.

Key dates

02Disclosure timeline

May 5, 2025 CVE published

May 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-4316 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html

Identifiers

CVE CVE-2025-4316

CWE CWE-284

Affected versions

Vendor Devolutions

Product Server

Affected ≥ 2025.1.3.0 and ≤ 2025.1.6.0

Vendor Devolutions

Product Server

Affected ≤ 2024.3.15.0