Lucene search
HistoryAug 07, 2023 - 5:15 p.m.
CVE-2023-32783
cve-2023-32783
zoho manageengine
adaudit plus
audit detection bypass
user accounts
security bug
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.017
Percentile
87.9%
The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a “$” symbol suffix. NOTE: the vendor states “We do not consider this as a security bug and it’s an expected behaviour.”
Affected configurations
Node
zohocorpmanageengine_adaudit_plusMatch7.1.1
microsoftwindowsMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| zohocorp | manageengine_adaudit_plus | 7.1.1 | cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.1.1:*:*:*:*:*:*:* |
| microsoft | windows | - | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2023-32783
2023-08-07 00:00:00
cve
cve
CVE-2023-32783
2023-08-07 17:15:11
prion
prion
Design/Logic Flaw
2023-08-07 17:15:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.017
Percentile
87.9%
Related for NVD:CVE-2023-32783