PT-2025-2604 · Zohocorp · Zoho Manageengine Applications Manager

Maneesh · Published 2025-01-29 · Updated 2025-01-29 · CVE-2024-41140

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine Applications Manager versions 174000 and prior

Description The issue is related to incorrect authorization in the update user function. This allows for potential unauthorized access or modifications. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions 174000 and prior, consider disabling the update user function until a patch is available. Restrict access to the update user functionality to minimize the risk of exploitation. Avoid using the update user function in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-41140

Affected Products

Zoho Manageengine Applications Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-41140 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41140 · Vendor Advisory
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-41140.html · Vendor Advisory
• https://twitter.com/WolfgangSesin/status/1884575779452764182 · Twitter Post
• https://twitter.com/CVEnew/status/1884563242543886550 · Twitter Post
• https://t.me/cvenotify/108969 · Telegram Post
• https://t.me/cvedetector/16681 · Telegram Post