Описание
Incorrect access control in Zoho ManageEngine ADManager Plus Build 7180 allows unauthenticated attackers to view user passwords after executing backup or recovery operations on user accounts.
Incorrect access control in Zoho ManageEngine ADManager Plus Build 7180 allows unauthenticated attackers to view user passwords after executing backup or recovery operations on user accounts.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2023-31492
- https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/admanager-recovery-password-disclosure.md
- https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-31492.html
- http://packetstormsecurity.com/files/177091/ManageEngine-ADManager-Plus-Recovery-Password-Disclosure.html
Связанные уязвимости
CVSS3: 6.5
nvd
больше 2 лет назад
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
CVSS3: 6.5
fstec
почти 3 года назад
Уязвимость программного обеспечения для управления сервисом Active Directory Zoho ManageEngine ADManager Plus, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации