CVE-2022-23849 Auth bypass in n/a
Attackers can bypass biometric authentication in Devolutions Password Hub for iOS by rapidly failing attempts, gaining unauthorized access to stored credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23849?
CVE-2022-23849 is a medium-severity authentication bypass vulnerability in n/a, published on 3 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker must rapidly make failed biometric authentication attempts.
Which versions are affected by CVE-2022-23849?
It affects 1 product.
Products include Devolutions Password Hub.
How do I fix CVE-2022-23849?
No fix has been published for CVE-2022-23849 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-23849 being exploited?
There is no known exploitation of CVE-2022-23849 in the wild and no public exploit code.
Sources
Also known as GHSA-qxhp-mp7h-vg86.