PT-2022-16703 · Zoho · Zoho Manageengine Admanager Plus

Dominique Righetto · Published 2022-03-01 · Updated 2023-08-08 · CVE-2022-24446

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Key Manager Plus version 6.1.6

Description An issue was discovered where a user with the level Operator can see all SSH servers and user information, even if no SSH server or user is associated with the operator.

Recommendations For Zoho ManageEngine Key Manager Plus version 6.1.6, consider restricting access to sensitive information for Operator-level users until a patch is available. As a temporary workaround, consider limiting the visibility of SSH servers and user information to only those associated with each Operator. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-24446

Affected Products

Zoho Manageengine Admanager Plus

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-24446 · Security Note
• https://manageengine.com/key-manager/release-notes.html#6200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24446 · Vendor Advisory
• https://t.me/cvenotify/27516 · Telegram Post
• https://t.me/cvenotify/27932 · Telegram Post
• https://excellium-services.com/cert-xlm-advisory/cve-2022-24446 · Note
• https://t.me/cibsecurity/38246 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-24446 · Note