What is CVE-2023-2257?

CVE-2023-2257 is a high-severity vulnerability in Apple Macos, classified under Incorrect Authorization. CVSS score: 7.8/10. Published 2023-04-24.

How severe is CVE-2023-2257?

High severity. CVSS v3 base score is 7.8 out of 10.

Auth bypass in Apple Macos

CVE-2023-2257

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.

Vulnerability class: Broken Access Control

EPSS: 0.002 (7.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apple Macos
Devolutions Workspace
Devolutions Workspace Desktop — versions 0
Microsoft Windows

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security@devolutions.net (Vendor Advisory)

Frequently asked questions

What is CVE-2023-2257?: CVE-2023-2257 is a high-severity vulnerability in Apple Macos, classified under Incorrect Authorization. CVSS score: 7.8/10. Published 2023-04-24.
How severe is CVE-2023-2257?: High severity. CVSS v3 base score is 7.8 out of 10.