4.3

CVE-2019-17112

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Datasecurity Plus Version4.0 Update4000
Zohocorp ≫ Manageengine Datasecurity Plus Version4.0 Update4002
Zohocorp ≫ Manageengine Datasecurity Plus Version4.0 Update4010
Zohocorp ≫ Manageengine Datasecurity Plus Version4.0 Update4015
Zohocorp ≫ Manageengine Datasecurity Plus Version4.0 Update4016
Zohocorp ≫ Manageengine Datasecurity Plus Version4.1 Update4100
Zohocorp ≫ Manageengine Datasecurity Plus Version4.1 Update4101
Zohocorp ≫ Manageengine Datasecurity Plus Version4.1 Update4110
Zohocorp ≫ Manageengine Datasecurity Plus Version4.1 Update4111
Zohocorp ≫ Manageengine Datasecurity Plus Version4.1 Update4120
Zohocorp ≫ Manageengine Datasecurity Plus Version4.2 Update4200
Zohocorp ≫ Manageengine Datasecurity Plus Version4.2 Update4201
Zohocorp ≫ Manageengine Datasecurity Plus Version4.2 Update4210
Zohocorp ≫ Manageengine Datasecurity Plus Version4.2 Update4211
Zohocorp ≫ Manageengine Datasecurity Plus Version4.3 Update4300
Zohocorp ≫ Manageengine Datasecurity Plus Version4.3 Update4301
Zohocorp ≫ Manageengine Datasecurity Plus Version4.3 Update4302
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5000
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5001
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5002
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5003
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5004
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5010
Zohocorp ≫ Manageengine Datasecurity Plus Version5.0 Update5011
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.75% 0.707
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
cve@mitre.org 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-552 Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.