PT-2023-24017 · Zoho · Zoho Manageengine Adaudit Plus

Pete Slade · Publicado 2023-08-07 · Atualizado 2024-08-02 · CVE-2023-32783

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADAudit Plus version 7.1.1

Description The event analysis component in Zoho ManageEngine ADAudit Plus allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. The vendor states that this behavior is expected and not considered a security bug.

Recommendations For Zoho ManageEngine ADAudit Plus version 7.1.1, consider restricting the creation or renaming of user accounts with a "$" symbol suffix to minimize the risk of audit detection bypass. As a temporary workaround, monitor user account activity closely for any suspicious behavior related to accounts with the "$" symbol suffix. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-32783

Produtos afetados

Zoho Manageengine Adaudit Plus

Referências · 7

• 🔥 https://peteslade.com/post/manageengine-adauditplus-cve-2023-32783 · Exploit
• https://t.me/cvenotify/73799 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-32783 · Nota de Segurança
• https://t.me/cibsecurity/67895 · Publicação no Telegram
• https://t.me/cvenotify/88582 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32783 · Aviso do Fabricante
• https://twitter.com/r4c0d382827/status/1768328869445095561 · Publicação no Twitter