Описание
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.
Ссылки
- Third Party AdvisoryUS Government Resource
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 8.3 (включая)
cpe:2.3:a:zohocorp:manageengine_opstor:*:*:*:*:*:*:*:*
EPSS
Процентиль: 79%
0.01279
Низкий
6.5 Medium
CVSS2
Дефекты
CWE-264
Связанные уязвимости
github
больше 3 лет назад
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.
EPSS
Процентиль: 79%
0.01279
Низкий
6.5 Medium
CVSS2
Дефекты
CWE-264