Lucene search

TenableCVELIST:CVE-2023-2291

HistoryApr 26, 2023 - 12:00 a.m.

CVE-2023-2291

2023-04-2600:00:00

tenable

www.cve.org

static credentials

postgresql

manageengine amp

password manager pro

pam360

privilege escalation

9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

16.0%

JSON

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Zoho ManageEngine Multiple Products",
    "versions": [
      {
        "version": "All",
        "status": "affected"
      }
    ]
  }
]

References

tenable.com/security/research/tra-2023-16