PT-2023-4674 · Zoho · Zoho Manageengine Admanager Plus

Son Nguyen · Published 2023-07-30 · Updated 2025-10-23 · CVE-2023-39912

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADManager Plus versions prior to 7203

Description The issue is related to inadequate access control in the Zoho ManageEngine ADManager Plus software, which can be exploited by a remote attacker to gain unauthorized access to protected information. Specifically, it allows Help Desk Technician users to read arbitrary files on the machine where the product is installed, and admin users can download any file from the server machine via directory traversal.

Recommendations For versions prior to 7203, update to version 7203 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories on the server machine to minimize the risk of exploitation. Additionally, limit the privileges of Help Desk Technician users to prevent them from reading arbitrary files.

Fix

Information Disclosure

Path traversal

Improper Access Control

Weakness Enumeration

CWE-200

CWE-264

CWE-22

CWE-284

Related Identifiers

BDU:2023-05087

CVE-2023-39912

ZDI-23-1401

Affected Products

Zoho Manageengine Admanager Plus

References · 11

• https://manageengine.com/products/ad-manager/admanager-kb/cve-2023-39912.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1401 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-39912 · Security Note
• https://bdu.fstec.ru/vul/2023-05087 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39912 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1697409916556763625 · Twitter Post
• https://manageengine.com · Note
• https://t.me/cibsecurity/69616 · Telegram Post
• https://t.me/cvenotify/126746 · Telegram Post
• https://t.me/cveNotify/139994 · Telegram Post
• https://vuldb.com/?id.238530 · Note