CVE-2020-9346

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
8.8HIGH
EPSS
0.5%
top 34.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zohocorp Manageengine Password Manager PRO
Timeline
PublishedMar 16
Latest updateMay 24

Description

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-9www-m7p9-p7jr: Zoho ManageEngine Password Manager Pro 10↗2022-05-24
▶
CVEList
CVE-2020-9346: Zoho ManageEngine Password Manager Pro 10↗2020-03-16
▶
CVE-2020-9346 (HIGH CVSS 8.8) | Zoho ManageEngine Password Manager | cvebase.io