Authorization

2020-01-3116:15:00

PRIOn knowledge base

www.prio-n.com

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup name, and description (but not the password).

CPENameOperatorVersion
manageengine_remote_access_pluslt10.0.450

CPE	Name	Operator	Version
	manageengine_remote_access_plus	lt	10.0.450

References

excellium-services.com/cert-xlm-advisory/CVE-2020-8422

excellium-services.com/cert-xlm-advisory/cve-2020-8422/