Auth bypass in Zohocorp Manageengine_ad360
CVE-2023-35785
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110…
Vulnerability class: Broken Authentication
EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Zohocorp Manageengine_ad360 — versions 4.3
- Zohocorp Manageengine_adaudit_plus — versions 7.2
- Zohocorp Manageengine_admanager_plus — versions 7.2
- Zohocorp Manageengine_assetexplorer — versions 6.9, 7.0
- Zohocorp Manageengine_cloud_security_plus — versions 4.1
- Zohocorp Manageengine_datasecurity_plus — versions 6.1
- Zohocorp Manageengine_eventlog_analyzer — versions 12.3.0
- Zohocorp Manageengine_exchange_reporter_plus — versions 5.7
- Zohocorp Manageengine_log360 — versions 5.3
- Zohocorp Manageengine_log360_ueba — versions 4.0
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-35785?
- CVE-2023-35785 is a high-severity vulnerability in Zohocorp Manageengine_ad360, classified under Improper Authentication. CVSS score: 8.1/10. Published 2023-08-28.
- How severe is CVE-2023-35785?
- High severity. CVSS v3 base score is 8.1 out of 10.