CVE-2023-38332 : Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take

Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure.

Published 2023-08-04 18:15:14

Updated 2023-08-09 17:13:25

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-38332

Zohocorp » Manageengine Admanager Plus
Versions before (<) 7.2
cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Admanager Plus » Version: 7.2 Update 7200
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.2:7200:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Admanager Plus » Version: 7.2 Update 7201
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.2:7201:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 20 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

https://manageengine.com

ManageEngine - IT Operations and Service Management Software
Product

CVEs referencing this url
https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-38332.html

2FA Bypass Vulnerability in ADManager Plus | CVE- 2023-38332
Vendor Advisory

Jump to