CVE-2023-2291

Exploit

EPSS 0.03%
Published 26.04.2023 21:15:09
Last modified 03.02.2025 18:15:30
Source vulnreport@tenable.com
Teams watchlist Login
Open Login

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Zohocorp ≫ Manageengine Access Manager Plus Version4.3 Updatebuild4309

Zohocorp ≫ Manageengine Pam360

Zohocorp ≫ Manageengine Password Manager Pro

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.03%	0.061

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://tenable.com/security/research/tra-2023-16

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2023-2291

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-2291

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-2291

EUVD