User Enumeration Vulnerability in Zoho ManageEngine Password Manager Pro

CVE-2021-33617

What is CVE-2021-33617?

The vulnerability in Zoho ManageEngine Password Manager Pro allows attackers to determine whether a username exists in the system by analyzing the responses to failed login attempts. Specifically, when a login attempt is made with an invalid username, the system provides a null response. This can allow malicious actors to enumerate valid usernames, potentially leading to further attacks such as account takeover or unauthorized access to sensitive information.

References