{"id":"CVE-2025-1231","aliases":["EUVD-2025-2094","GHSA-mjmw-3m65-4c84"],"status":"published","title":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an...","description":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0035,"percentile":0.29058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-640"],"published":"2025-02-11T14:05:38Z","modified":"2026-06-17T08:38:39Z","products":[{"vendor":"devolutions","product":"devolutions_server"},{"vendor":"devolutions","product":"server"}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2025-0002/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1231"},{"url":"https://devolutions.net/security/advisories/DEVO-2025-0002"},{"url":"https://github.com/advisories/GHSA-mjmw-3m65-4c84"}],"sources":{"cve":[{"id":"CVE-2025-1231","description":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.","status":"published","published":"2025-02-11T14:05:38.399Z","modified":"2025-02-11T14:56:16.812Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-2094","description":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.","status":"published","published":"2025-02-11T14:05:38Z","modified":"2025-02-11T14:56:16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:59.807436Z"}],"ghsa":[{"id":"GHSA-mjmw-3m65-4c84","title":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an...","description":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.","status":"published","published":"2025-02-11T15:32:24Z","modified":"2025-03-28T18:33:04Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287","CWE-640"],"updated_at":"2026-11-02T15:00:31.530223Z"}],"nvd":[{"id":"CVE-2025-1231","description":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.","status":"published","published":"2025-02-11T14:15:31.13Z","modified":"2026-06-17T08:38:39.067Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287","CWE-640"],"updated_at":"2026-11-02T14:10:50.916773Z"}]}}