CVE-2024-5678

CWE-89 — SQL Injection6 documents5 sources
Severity
4.7MEDIUM
EPSS
1.5%
top 18.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Manageengine Applications ManagerZohocorp Manageengine Applications Manager
Timeline
PublishedAug 1
Latest updateOct 15

Description

Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LExploitability: 1.2 | Impact: 3.4

Affected Packages2 packages

🔴Vulnerability Details

3
CVEList
SQL Injection↗2024-08-01
▶
GHSA
GHSA-rrc8-qmq6-vv7c: Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monito↗2024-08-01
▶
OSV
openssl vulnerabilities↗2024-02-13
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (OpenSSL) — CVE-2023-5678↗2024-10-15
▶
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Server Infrastructure (OpenSSL) — CVE-2023-5678↗2024-07-15
▶
CVE-2024-5678 (MEDIUM CVSS 4.7) | Zohocorp ManageEngine Applications | cvebase.io