6.5

CVE-2023-31492

Exploit
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update -
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7100
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7101
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7102
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7110
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7111
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7112
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7113
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7114
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7115
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7116
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7117
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7118
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7120
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7121
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7122
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7123
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7124
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7125
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7126
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7130
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7131
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7140
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7141
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7150
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7151
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7160
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7161
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7162
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7163
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7170
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7171
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7180
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7181
Zohocorp ≫ Manageengine Admanager Plus Version 7.1 Update 7182
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.9% 0.942
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

http://packetstormsecurity.com/files/177091/ManageEngine-ADManager-Plus-Recovery-Password-Disclosure.html
https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/admanager-recovery-password-disclosure.md
Third Party Advisory
Exploit
https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-31492.html
Vendor Advisory