Vulnerability · Published Apr 26, 2023 · Assigned by tenable
CVE-2023-2291
High 7.8
In plain English
A high-severity hard-coded credentials in Zoho ManageEngine Multiple Products. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.8%top 43.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Zoho ManageEngine Multiple Products | All |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H