PT-2023-21663 · Zoho · Zoho Manageengine Applications Manager

Da22Le · Published 2023-04-11 · Updated 2023-04-14 · CVE-2023-28340

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions through 16320

Description The issue allows an admin user to conduct an XXE attack.

Recommendations For versions through 16320, update to a version that contains a fix for this issue to prevent XXE attacks.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-28340

Affected Products

Zoho Manageengine Applications Manager

References · 6

• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-28340.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28340 · Security Note
• https://t.me/cvenotify/47979 · Telegram Post
• https://t.me/cibsecurity/61836 · Telegram Post
• https://manageengine.com · Note