PT-2023-27917 · Zoho · Manageengine Mobile Device Manager

Xin-Yue Song · Publicado 2023-11-02 · Atualizado 2023-11-13 · CVE-2023-41344

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NCSIST ManageEngine Mobile Device Manager(MDM) APP (affected versions not specified)

Description The issue is related to a path traversal vulnerability in a special function of the NCSIST ManageEngine Mobile Device Manager(MDM) APP. This vulnerability can be exploited by an unauthenticated remote attacker to bypass authentication and read arbitrary system files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-41344

Produtos afetados

Manageengine Mobile Device Manager

Referências · 5

• https://twcert.org.tw/tw/cp-132-7507-55b28-1.html · Nota
• https://twitter.com/VulmonFeeds/status/1720393131168817440 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1720324761618628869 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-41344 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-41344 · Aviso do Fabricante