CVE-2025-3517 — Devolutions / Devolutions Server

CVE-2025-3517

Devolutions / Devolutions Server PUBLISHED

Description (CNA)

Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.

Affected (CNA)

Vendor / product	Versions
Devolutions / Devolutions Server	affected 0 through 2025.1.5.0

CWE

CWE-266

References

https://devolutions.net/security/advisories/DEVO-2025-0006/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.