PT-2024-35177 · Zohocorp · Manageengine Analytics Plus

Mohamed Mekkawy · Published 2024-11-27 · Updated 2024-12-11 · CVE-2024-52323

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine Analytics Plus versions below 6100

Description The issue allows authenticated sensitive data exposure, enabling users to retrieve sensitive tokens associated with the org-admin account. This is related to the getOAToken method, which is exposed and can lead to privilege escalation. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions below 6100, upgrade to a version 6100 or later to mitigate the risk of sensitive data exposure. As a temporary workaround, consider restricting access to the getOAToken method until a patch is available.

Fix

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-276

CWE-200

Related Identifiers

CVE-2024-52323

ZDI-24-1676

Affected Products

Manageengine Analytics Plus

References · 8

• https://manageengine.com/analytics-plus/CVE-2024-52323.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52323 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-1676 · Security Note
• https://twitter.com/TheZDIBugs/status/1866934858880082113 · Twitter Post
• https://t.me/latest_high_impact_cve/1578 · Telegram Post
• https://twitter.com/oktsec/status/1861751327274983859 · Twitter Post
• https://twitter.com/CVEnew/status/1861715595797901417 · Twitter Post