CVE-2023-2257

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-24 · updated 2026-06-17
Weakness: CWE-863

Description

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.

Affected products

Devolutions Workspace: before 2023.1.1.4 — fixed in 2023.1.1.4

How to fix

Upgrade to a fixed version: Devolutions Workspace 2023.1.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-2257 or the next vulnerability affects your stack