PT-2024-5293 · Zoho · Zoho Manageengine Adaudit Plus

Andreas · Published 2023-12-29 · Updated 2025-05-16 · CVE-2024-36036

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADAudit Plus versions 7260 and below

Description The issue is related to information disclosure in Zoho ManageEngine ADAudit Plus, a Windows Active Directory management and reporting tool. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information or modify the configuration of the software. It is reported that unauthorized local agent machine users can access sensitive information and modify the agent configuration.

Recommendations For Zoho ManageEngine ADAudit Plus versions 7260 and below, update to a version above 7260 to resolve the issue. As a temporary workaround, consider restricting access to the agent configuration to minimize the risk of exploitation.

Fix

Improper Access Control

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-284

CWE-862

CWE-200

Related Identifiers

BDU:2024-05915

BDU:2024-05916

CVE-2024-36036

Affected Products

Zoho Manageengine Adaudit Plus

References · 12

• https://osv.dev/vulnerability/CVE-2024-36036 · Vendor Advisory
• https://manageengine.com/products/active-directory-audit/cve-2024-36036.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36036 · Security Note
• https://bdu.fstec.ru/vul/2024-05915 · Security Note
• https://t.me/cvenotify/100192 · Telegram Post
• https://t.me/cybersecuritytechnologies/10583 · Telegram Post
• https://vuldb.com/?id.266364 · Note
• https://t.me/cvenotify/81095 · Telegram Post
• https://t.me/thebugbountyhunter/8755 · Telegram Post
• https://t.me/secharvester/16294 · Telegram Post
• https://t.me/cvenotify/122628 · Telegram Post