Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.
Las versiones de Zohocorp ManageEngine Analytics Plus anteriores a 6100 son vulnerables a la exposición de datos confidenciales autenticados, lo que permite a los usuarios recuperar tokens confidenciales asociados a la cuenta de administrador de la organización.
This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine Analytics Plus. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the getOAToken action. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
