PT-2023-7422 · Manageengine · Zoho Manageengine Admanager Plus

Simon Humbert · Publicado 2023-01-12 · Atualizado 2025-03-17 · CVE-2023-29084

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine ADManager Plus versions prior to 7181

Description The issue allows for authenticated users to exploit command injection via Proxy settings. This is due to the lack of neutralization of special elements used in the operating system command. Exploitation of the issue may allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 7181, update to version 7181 or later to resolve the command injection issue in the Proxy settings. As a temporary workaround, consider restricting access to the Proxy settings until a patch is available.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2023-08459

CVE-2023-29084

ZDI-23-438

Produtos afetados

Zoho Manageengine Admanager Plus

Referências · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb · Exploit
• 🔥 https://github.com/ohnonoyesyes/CVE-2023-29084 · Exploit
• https://manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html · Aviso do Fabricante
• https://vuldb.com/ru/?id.225801 · Nota
• https://t.me/ckure/12326 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-08459 · Nota de Segurança
• https://t.me/rnetsec/18582 · Publicação no Telegram
• https://t.me/csirt_italia/2296 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-29084 · Aviso do Fabricante
• https://t.me/p0x3k/1427 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29084 · Nota de Segurança
• https://t.me/defcon_news/112358 · Publicação no Telegram
• https://t.me/pentestingnews/35082 · Publicação no Telegram
• https://t.me/hybgl/1605 · Publicação no Telegram
• http://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.html · Nota