PT-2023-22287 · Zoho · Zoho Manageengine Network Configuration Manager

Published 2023-08-04 · Updated 2023-08-10 · CVE-2023-29505

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Network Configuration Manager version 12.6.165

Description An issue was discovered in the WebSocket endpoint, allowing Cross-site WebSocket hijacking.

Recommendations For Zoho ManageEngine Network Configuration Manager version 12.6.165, consider restricting access to the WebSocket endpoint as a temporary workaround until a patch is available.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2023-29505

Affected Products

Zoho Manageengine Network Configuration Manager

References · 7

• https://osv.dev/vulnerability/CVE-2023-29505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29505 · Security Note
• https://excellium-services.com/cert-xlm-advisory/CVE-2023-29505 · Note
• https://manageengine.com/itom/advisory/cve-2023-29505.html · Note
• https://manageengine.com/network-monitoring/help/read-me-complete.html#build_127131 · Note
• https://t.me/cibsecurity/67764 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-29505 · Note