IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-01-19 15:15

MODIFIED

2026-01-19 15:15

EPSS (Prob. Exploit)

0.22%

Top 87.5%

DATA SOURCES:

NVD 🔗 2026-01-19 CVE PROJECT 🔗 2026-01-19 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04

> DESCRIPTION

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-863

> CWE DETAILED DESCRIPTIONS

CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

> GITHUB SECURITY ADVISORY

GHSA-5h3f-q97h-ccvc CRITICAL

vm2: NodeVM custom resolution bypasses external path boundaries

AFFECTED PACKAGES:

NPM / vm2

<= 3.12.1

Fixed in: 3.12.2

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/01/2026 15:15

Source: NVD

📊 ENRICHISSEMENT 01/02/2026 06:44

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

📊 ENRICHISSEMENT 19/01/2026 17:39

CVEPROJECT

Champ modifié: CVE Project