PT-2023-9281 · Zoho · Zoho Manageengine Adaudit Plus

Andreas · Publicado 2023-12-29 · Atualizado 2024-11-27 · CVE-2024-36037

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADAudit Plus versions 7260 and below

Description The issue is related to insufficient access control in Zoho ManageEngine ADAudit Plus, a Windows Active Directory management and reporting tool. This allows unauthorized local agent machine users to view session recordings of other users.

Recommendations For Zoho ManageEngine ADAudit Plus versions 7260 and below, consider restricting access to session recordings until a patch is available. As a temporary workaround, limit the privileges of local agent machine users to prevent them from viewing sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Enumeração de Fraquezas

CWE-863

CWE-284

Identificadores relacionados

BDU:2024-05915

CVE-2024-36037

Produtos afetados

Zoho Manageengine Adaudit Plus

Referências · 12

• https://vuldb.com/?id.266364 · Nota
• https://t.me/cybersecuritytechnologies/10583 · Publicação no Telegram
• https://t.me/secharvester/16294 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-05915 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-36037 · Aviso do Fabricante
• https://t.me/cvenotify/81096 · Publicação no Telegram
• https://t.me/cvenotify/97359 · Publicação no Telegram
• https://t.me/thebugbountyhunter/8755 · Publicação no Telegram
• https://manageengine.com/products/active-directory-audit/cve-2024-36037.html · Aviso do Fabricante
• https://manageengine.com/products/active-directory-audit/cve-2024-36036.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-36037 · Nota de Segurança
• https://t.me/cvenotify/99552 · Publicação no Telegram