PT-2023-7422 · Manageengine · Zoho Manageengine Admanager Plus

Simon Humbert · Published 2023-01-12 · Updated 2025-03-17 · CVE-2023-29084

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine ADManager Plus versions prior to 7181

Description The issue allows for authenticated users to exploit command injection via Proxy settings. This is due to the lack of neutralization of special elements used in the operating system command. Exploitation of the issue may allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 7181, update to version 7181 or later to resolve the command injection issue in the Proxy settings. As a temporary workaround, consider restricting access to the Proxy settings until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2023-08459

CVE-2023-29084

ZDI-23-438

Affected Products

Zoho Manageengine Admanager Plus

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb · Exploit
• 🔥 https://github.com/ohnonoyesyes/CVE-2023-29084 · Exploit
• https://manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08459 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29084 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-438 · Security Note
• https://vuldb.com/ru/?id.225801 · Note
• https://t.me/ckure/12326 · Telegram Post
• https://t.me/rnetsec/18582 · Telegram Post
• https://t.me/csirt_italia/2296 · Telegram Post
• https://t.me/p0x3k/1427 · Telegram Post
• https://t.me/defcon_news/112358 · Telegram Post
• https://t.me/pentestingnews/35082 · Telegram Post
• https://t.me/hybgl/1605 · Telegram Post