CVE-2021-28048: Devolutions Server

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted HTML page.

Affected products

• Devolutions Devolutions Server: before 2020.3.18 (fixed in 2020.3.18); before 2021.1 (fixed in 2021.1)

Published 2021-04-14. Last modified 2026-06-17.