CVSS: 6.5EPSS: 0%CPEs: 36EXPL: 1CVE-2023-31492 – ManageEngine ADManager Plus Recovery Password Disclosure
https://notcve.org/view.php?id=CVE-2023-31492
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users. ADManager Plus versión 7182 y anteriores de ManageEngine de Zoho divulgaron las contraseñas predeterminadas para la restauración de cuentas de dominios no autorizadas a los usuarios autenticados. ManageEngine ADManager Plus versions prior to build 7183 suffers from a recovery password disclosure vulnerability. • http://packetstormsecurity.com/files/177091/ManageEngine-ADManager-Plus-Recovery-Password-Disclosure.html https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/admanager-recovery-password-disclosure.md https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-31492.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-38332
https://notcve.org/view.php?id=CVE-2023-38332
Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure. ADManager Plus de ManageEngine de Zoho a través de 7201 permiten a los usuarios autenticados hacerse cargo de la cuenta de otro usuario a través de la divulgación de información sensible. • https://manageengine.com https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-38332.html •
CVSS: 4.9EPSS: 0%CPEs: 36EXPL: 0CVE-2023-35786
https://notcve.org/view.php?id=CVE-2023-35786
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. • https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-35786.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.2EPSS: 60%CPEs: 33EXPL: 2CVE-2023-29084 – ManageEngine ADManager Plus ChangePasswordAction Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-29084
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the ChangePasswordAction function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. • https://github.com/ohnonoyesyes/CVE-2023-29084 http://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.html https://manageengine.com https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus https://www.zerodayinitiative.com/advisories/ZDI-23-438 https://www.manageengine.com/products/ad-manager/release-notes.html https://raw.githubusercontent.com/rapid7/metasplo • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 97%CPEs: 158EXPL: 12CVE-2022-47966 – Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active). Múltiples productos locales de Zoho ManageEngine, como ServiceDesk Plus hasta 14003, permiten la ejecución remota de código debido al uso de Apache Santuario xmlsec (también conocido como XML Security para Java) 1.4.1, porque las funciones xmlsec XSLT, por diseño en esa versión, hacen la aplicación responsable de ciertas protecciones de seguridad, y las aplicaciones ManageEngine no proporcionaban esas protecciones. • https://github.com/horizon3ai/CVE-2022-47966 https://github.com/vonahisec/CVE-2022-47966-Scan https://github.com/Inplex-sys/CVE-2022-47966 http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html https://attackerkb.com/topic • CWE-20: Improper Input Validation •