Zohocorp ManageEngine Exchange Reporter Plus vulnerable to SQL Injection
CVE-2024-6204

8.1HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Exchange Reporter Plus
Vendor
CVE Published:
30 August 2024

What is CVE-2024-6204?

The vulnerability identified in ManageEngine Exchange Reporter Plus involves a SQL Injection flaw in the reports module. Attackers may exploit this weakness to execute arbitrary SQL commands, potentially accessing or manipulating the database. This could lead to unauthorized data disclosure, data corruption, or other serious security breaches. Users of versions before 5715 are advised to apply the necessary updates to mitigate these risks effectively.

References

https://www.manageengine.com/products/exchange-reports/ad...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.