Information Disclosure Vulnerability in Zoho ManageEngine EventLog Analyzer

CVE-2019-19774

What is CVE-2019-19774?

An information disclosure vulnerability exists in Zoho ManageEngine EventLog Analyzer 10.0 SP1 and earlier, which allows attackers to bypass security measures designed to protect sensitive credential data. By executing a specific SQL query at the /event/runquery.do endpoint, even administrative users can retrieve MD5 hashes of authentication accounts stored within the application, including those belonging to administrative users. This flaw circumvents restrictions that typically prevent access to password-related data and poses a significant risk to enterprise security.

References