Manageengine Analytics Plus
Monthly
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionality due to use of a vulnerable Apache XML Security library, massively exploited in January 2023.
Authenticated SQL injection in Zoho ManageEngine Analytics Plus 6.1 (builds 6100 through 6171 and earlier) allows any low-privileged user with network access to the application's 'key update API' to inject arbitrary SQL and read or modify the underlying database, with high impact to confidentiality, integrity and availability (CVSS 8.8, PR:L). The attack is network-based with low complexity and no user interaction, but the authentication requirement (verified from the CVSS vector PR:L) means an attacker must already hold valid credentials - obtained directly, through weak credential hygiene, credential reuse, or phishing - so unauthenticated internet-wide exploitation is not possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the EPSS score of 27.38% (98th percentile) signals an elevated predicted likelihood of exploitation activity, making this a genuine priority rather than a high-CVSS-but-low-risk finding.
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionality due to use of a vulnerable Apache XML Security library, massively exploited in January 2023.
Authenticated SQL injection in Zoho ManageEngine Analytics Plus 6.1 (builds 6100 through 6171 and earlier) allows any low-privileged user with network access to the application's 'key update API' to inject arbitrary SQL and read or modify the underlying database, with high impact to confidentiality, integrity and availability (CVSS 8.8, PR:L). The attack is network-based with low complexity and no user interaction, but the authentication requirement (verified from the CVSS vector PR:L) means an attacker must already hold valid credentials - obtained directly, through weak credential hygiene, credential reuse, or phishing - so unauthenticated internet-wide exploitation is not possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the EPSS score of 27.38% (98th percentile) signals an elevated predicted likelihood of exploitation activity, making this a genuine priority rather than a high-CVSS-but-low-risk finding.
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.