Two-Factor Authentication Bypass in Zoho ManageEngine ADManager Plus
CVE-2023-41904

5.4MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Admanager Plus
Vendor
CVE Published:
27 September 2023

What is CVE-2023-41904?

A vulnerability in Zoho ManageEngine ADManager Plus prior to version 7203 allows attackers to bypass two-factor authentication during AuthToken generation in REST APIs. This exposes sensitive data and user accounts to unauthorized access, potentially compromising security measures intended to protect system integrity.

References

https://www.manageengine.com/products/ad-manager/admanage...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2023-41904 : Two-Factor Authentication Bypass in Zoho ManageEngine ADManager Plus