Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2023-6105

ManageEngine Information Disclosure in Multiple Products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tenable

Description

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ManageEngine Service Desk Plus

Default version status: unaffected

  • 0 to < 14304affected

ManageEngine Asset Explorer

Default version status: unaffected

  • 0 to < 7004affected

ManageEngine Access Manager Plus

Default version status: unaffected

  • 0 to < 14304affected

References