CVE-2023-39912

Опубликовано: 31 авг. 2023

Источник: nvd

CVSS3: 4.9

EPSS Низкий

Описание

Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.

Ссылки

https://manageengine.com
Product
https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-39912.html
Vendor Advisory
https://manageengine.com
Product
https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-39912.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*

Версия до 7.2 (исключая)

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.2:7200:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.2:7201:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.2:7202:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00937

Низкий

4.9 Medium

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-8289-x38r-723c

CVSS3: 4.9

github

больше 2 лет назад

Zoho ManageEngine ADManager Plus through 7202 allows admin users to download any file from the server machine via directory traversal.

BDU:2023-05087

CVSS3: 7.1

fstec