PT-2023-24017 · Zoho · Zoho Manageengine Adaudit Plus

Pete Slade · Published 2023-08-07 · Updated 2024-08-02 · CVE-2023-32783

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADAudit Plus version 7.1.1

Description The event analysis component in Zoho ManageEngine ADAudit Plus allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. The vendor states that this behavior is expected and not considered a security bug.

Recommendations For Zoho ManageEngine ADAudit Plus version 7.1.1, consider restricting the creation or renaming of user accounts with a "$" symbol suffix to minimize the risk of audit detection bypass. As a temporary workaround, monitor user account activity closely for any suspicious behavior related to accounts with the "$" symbol suffix. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-32783

Affected Products

Zoho Manageengine Adaudit Plus

References · 7

• 🔥 https://peteslade.com/post/manageengine-adauditplus-cve-2023-32783 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-32783 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32783 · Vendor Advisory
• https://t.me/cvenotify/73799 · Telegram Post
• https://t.me/cibsecurity/67895 · Telegram Post
• https://t.me/cvenotify/88582 · Telegram Post
• https://twitter.com/r4c0d382827/status/1768328869445095561 · Twitter Post