How severe is CVE-2024-2241?

CVE-2024-2241 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2024-2241 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-2241?

CVE-2024-2241 affects Devolutions Workspace. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-2241?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-2241 have an EU (EUVD) identifier?

Yes. CVE-2024-2241 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-27197.

When was CVE-2024-2241 published?

CVE-2024-2241 was published on 2024-03-07 and last updated on 2026-06-17.

CVE-2024-2241

CVE-2024-2241 is a medium-severity vulnerability in Devolutions Workspace with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-27197
Affected product: Devolutions Workspace
Published: 2024-03-07
Last modified: 2026-06-17

Description

Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via specific permissions

Frequently asked questions

What is CVE-2024-2241?: Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via specific permissions
How severe is CVE-2024-2241?: CVE-2024-2241 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2024-2241 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-2241?: CVE-2024-2241 affects Devolutions Workspace. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-2241?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-2241 have an EU (EUVD) identifier?: Yes. CVE-2024-2241 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-27197.
When was CVE-2024-2241 published?: CVE-2024-2241 was published on 2024-03-07 and last updated on 2026-06-17.

References

https://devolutions.net/security/advisories/DEVO-2024-0003

Affected products (1)

cpe:2.3:a:devolutions:workspace:*:*:*:*:-:*:*:*

More vulnerabilities in Devolutions Workspace

CVE-2023-2257 — High (CVSS 7.8): Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows…
CVE-2023-6588 — Medium (CVSS 6.5): Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions…

All CVEs affecting Devolutions Workspace →