PT-2024-5582 · Manageengine · Zoho Manageengine Exchange Reporter Plus

Minhgalaxy · Published 2024-07-15 · Updated 2024-09-11 · CVE-2024-38871

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine Exchange Reporter Plus versions 5717 and below

Description The issue is related to the lack of protection against SQL query structure attacks in the reports module of ManageEngine Exchange Reporter Plus. This can allow a remote attacker to execute arbitrary SQL queries to the database. The exploitation of this issue is possible through authenticated SQL injection in the reports module.

Recommendations For versions 5717 and below, update to a version above 5717 to resolve the issue. As a temporary workaround, consider restricting access to the reports module until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-06267

CVE-2024-38871

Affected Products

Zoho Manageengine Exchange Reporter Plus

References · 8

• https://manageengine.com/products/exchange-reports/advisory/CVE-2024-38871.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38871 · Security Note
• https://bdu.fstec.ru/vul/2024-06267 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38871 · Vendor Advisory
• https://t.me/cvenotify/94187 · Telegram Post
• https://t.me/cvedetector/1710 · Telegram Post
• https://t.me/cvenotify/87596 · Telegram Post
• https://t.me/true_secator/6041 · Telegram Post