PT-2019-14951 · Zoho · Zoho Manageengine Datasecurity Plus

Dominique Righetto · Published 2019-10-09 · Updated 2019-11-20 · CVE-2019-17112

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine DataSecurity Plus versions prior to 5.0.1 5012

Description An issue was discovered that allows a basic user with "Operator" access level to access the configuration file of the mail server, excluding the password, due to an exposed service.

Recommendations For versions prior to 5.0.1 5012, update to version 5.0.1 5012 or later to resolve the issue.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2019-17112

Affected Products

Zoho Manageengine Datasecurity Plus

References · 4

• https://manageengine.com/data-security/release-notes.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17112 · Security Note
• https://excellium-services.com/cert-xlm-advisory/cve-2019-17112 · Note