CVE-2024-52323

CWE-200 — Information Exposure CWE-276 — Incorrect Default Permissions3 documents3 sources

Severity

8.1HIGH

EPSS

0.7%

top 28.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Analytics Plus Zohocorp Manageengine Analytics Plus

Timeline

PublishedNov 27

Description

Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDzohocorp/manageengine_analytics_plus< 6.1

▶CVEListV5manageengine/analytics_plus< 6100

🔴Vulnerability Details

GHSA

GHSA-vhw5-84xr-rjmq: Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve se↗2024-11-27

▶

CVEList

Sensitive Data Exposure↗2024-11-27

▶