Command Execution Vulnerability in Zoho ManageEngine RecoveryManager Plus
CVE-2023-48646

7.2HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Recoverymanager Plus
Vendor
CVE Published:
22 November 2023

What is CVE-2023-48646?

An administrative oversight in Zoho ManageEngine RecoveryManager Plus prior to version 6070 allows users with admin access to exploit proxy settings for executing arbitrary commands. This vulnerability poses a significant risk as it could lead to unauthorized actions within the system, affecting data integrity and security. Users of the affected version are advised to upgrade promptly to the latest version to mitigate this risk.

References

https://www.manageengine.com/ad-recovery-manager/advisory...

EPSS Score

62% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.