CVE-2024-6204

CWE-89 — SQL Injection3 documents3 sources

Severity

8.1HIGH

EPSS

0.3%

top 44.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Exchange Reporter Plus Zohocorp Manageengine Exchange Reporter Plus

Timeline

PublishedAug 30

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LExploitability: 2.8 | Impact: 5.5

Affected Packages2 packages

▶NVDzohocorp/manageengine_exchange_reporter_plus< 5.7+1

▶CVEListV5manageengine/exchange_reporter_plus< 5715

🔴Vulnerability Details

GHSA

GHSA-v323-q9x3-gg6h: Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module↗2024-08-30

▶

CVEList

SQL injection↗2024-08-30

▶