PT-2023-9281 · Zoho · Zoho Manageengine Adaudit Plus

Andreas · Published 2023-12-29 · Updated 2024-11-27 · CVE-2024-36037

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADAudit Plus versions 7260 and below

Description The issue is related to insufficient access control in Zoho ManageEngine ADAudit Plus, a Windows Active Directory management and reporting tool. This allows unauthorized local agent machine users to view session recordings of other users.

Recommendations For Zoho ManageEngine ADAudit Plus versions 7260 and below, consider restricting access to session recordings until a patch is available. As a temporary workaround, limit the privileges of local agent machine users to prevent them from viewing sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

BDU:2024-05915

CVE-2024-36037

Affected Products

Zoho Manageengine Adaudit Plus

References · 12

• https://bdu.fstec.ru/vul/2024-05915 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36037 · Vendor Advisory
• https://manageengine.com/products/active-directory-audit/cve-2024-36037.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36037 · Security Note
• https://vuldb.com/?id.266364 · Note
• https://t.me/cybersecuritytechnologies/10583 · Telegram Post
• https://t.me/secharvester/16294 · Telegram Post
• https://t.me/cvenotify/81096 · Telegram Post
• https://t.me/cvenotify/97359 · Telegram Post
• https://t.me/thebugbountyhunter/8755 · Telegram Post
• https://manageengine.com/products/active-directory-audit/cve-2024-36036.html · Note
• https://t.me/cvenotify/99552 · Telegram Post