Privilege Escalation Vulnerability in Zoho ManageEngine ADAudit Plus
CVE-2022-24978

8.8HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Adaudit Plus
Vendor
CVE Published:
5 April 2022

What is CVE-2022-24978?

A vulnerability in Zoho ManageEngine ADAudit Plus versions before 7055 allows authenticated users to escalate their privileges due to the inappropriate exposure of a password field within a JSON response. This could enable attackers to gain unauthorized access to sensitive functionalities of the integrated products, potentially compromising system integrity.

References

https://manageengine.com
x_refsource_MISC
https://pitstop.manageengine.com/portal/en/community/topi...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-24978 : Privilege Escalation Vulnerability in Zoho ManageEngine ADAudit Plus