Lucene search

ManageEngineCVE-2024-38871

HistoryJul 26, 2024 - 6:15 p.m.

CVE-2024-38871

2024-07-2618:15:03

CWE-89

ManageEngine

web.nvd.nist.gov

zohocorp manageengine

exchange reporter plus

sql injection

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

31.9%

JSON

Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module.

Affected configurations

Nvd

Node

zohocorpmanageengine_exchange_reporter_plusRange<5.7

zohocorpmanageengine_exchange_reporter_plusMatch5.75700

zohocorpmanageengine_exchange_reporter_plusMatch5.75701

zohocorpmanageengine_exchange_reporter_plusMatch5.75702

zohocorpmanageengine_exchange_reporter_plusMatch5.75703

zohocorpmanageengine_exchange_reporter_plusMatch5.75704

zohocorpmanageengine_exchange_reporter_plusMatch5.75705

zohocorpmanageengine_exchange_reporter_plusMatch5.75706

zohocorpmanageengine_exchange_reporter_plusMatch5.75707

zohocorpmanageengine_exchange_reporter_plusMatch5.75708

zohocorpmanageengine_exchange_reporter_plusMatch5.75709

zohocorpmanageengine_exchange_reporter_plusMatch5.75710

zohocorpmanageengine_exchange_reporter_plusMatch5.75711

zohocorpmanageengine_exchange_reporter_plusMatch5.75712

zohocorpmanageengine_exchange_reporter_plusMatch5.75713

zohocorpmanageengine_exchange_reporter_plusMatch5.75714

zohocorpmanageengine_exchange_reporter_plusMatch5.75715

zohocorpmanageengine_exchange_reporter_plusMatch5.75717

VendorProductVersionCPE
zohocorpmanageengine_exchange_reporter_plus*cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5700:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5701:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5702:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5703:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5704:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5705:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5706:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5707:*:*:*:*:*:*
zohocorpmanageengine_exchange_reporter_plus5.7cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5708:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_exchange_reporter_plus	*	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus::::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5700::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5701::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5702::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5703::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5704::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5705::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5706::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5707::::::
zohocorp	manageengine_exchange_reporter_plus	5.7	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5708::::::

Rows per page:

1-10 of 181

CNA Affected

[
  {
    "collectionURL": "https://www.manageengine.com/",
    "defaultStatus": "unaffected",
    "product": "Exchange Reporter Plus",
    "vendor": "ManageEngine",
    "versions": [
      {
        "lessThan": "5717",
        "status": "affected",
        "version": "0",
        "versionType": "5717"
      }
    ]
  }
]

References

www.manageengine.com/products/exchange-reports/advisory/CVE-2024-38871.html

Social References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

31.9%

JSON

Related for CVE-2024-38871