Lucene search

TenableCVELIST:CVE-2023-6105

HistoryNov 15, 2023 - 8:57 p.m.

CVE-2023-6105 ManageEngine Information Disclosure in Multiple Products

2023-11-1520:57:47

CWE-200

tenable

www.cve.org

cve-2023-6105

manageengine

information disclosure

encryption keys

low-privileged user

product database

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

5.1%

JSON

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Service Desk Plus",
    "vendor": "ManageEngine",
    "versions": [
      {
        "lessThan": "14304",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Asset Explorer",
    "vendor": "ManageEngine",
    "versions": [
      {
        "lessThan": "7004",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Access Manager Plus",
    "vendor": "ManageEngine",
    "versions": [
      {
        "lessThan": "14304",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html

www.tenable.com/security/research/tra-2023-35

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2023-6105