Описание
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.
Ссылки
- ExploitThird Party AdvisoryVDB Entry
- ExploitMailing ListThird Party Advisory
- PatchVendor Advisory
- ExploitThird Party AdvisoryVDB Entry
- ExploitMailing ListThird Party Advisory
- PatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.0.3 (исключая)Версия до 6.0.1 (исключая)
Одно из
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:*:*:*:*:*:*:*:*
EPSS
Процентиль: 100%
0.89079
Высокий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-1188
Связанные уязвимости
github
больше 3 лет назад
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.
EPSS
Процентиль: 100%
0.89079
Высокий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-1188