Design/Logic Flaw

2022-04-2820:15:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.592 Medium

EPSS

Percentile

97.8%

JSON

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the …/RestAPI substring.

CPENameOperatorVersion
manageengine_access_manager_pluseq4.2 build4202
manageengine_access_manager_pluseq4.2 build4201
manageengine_access_manager_pluseq4.2 build4200
manageengine_access_manager_pluseq4.1 build4100
manageengine_access_manager_pluseq4.1 build4101
manageengine_access_manager_pluseq4.3 build4300
manageengine_access_manager_pluseq4.3 build4301
manageengine_access_manager_pluseq4.2 build4203
manageengine_access_manager_pluseq4.0 build4000
manageengine_pam360eq5.3 build5302

Name	Operator	Version
manageengine_access_manager_plus	eq	4.2 build4202
manageengine_access_manager_plus	eq	4.2 build4201
manageengine_access_manager_plus	eq	4.2 build4200
manageengine_access_manager_plus	eq	4.1 build4100
manageengine_access_manager_plus	eq	4.1 build4101
manageengine_access_manager_plus	eq	4.3 build4300
manageengine_access_manager_plus	eq	4.3 build4301
manageengine_access_manager_plus	eq	4.2 build4203
manageengine_access_manager_plus	eq	4.0 build4000
manageengine_pam360	eq	5.3 build5302