CVE-2023-6105

ManageEngine Information Disclosure in Multiple Products

Published Nov 15, 2023 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-58361 An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00064}

epss

{'score': 0.00084}

Type Values Removed Values Added
Description An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Subscriptions

Linux Linux Kernel
Microsoft Windows
Zohocorp Manageengine Access Manager Plus Manageengine Adaudit Plus Manageengine Admanager Plus Manageengine Adselfservice Plus Manageengine Analytics Plus Manageengine Appcreator Manageengine Application Control Plus Manageengine Assetexplorer Manageengine Browser Security Plus Manageengine Cloud Security Plus Manageengine Datasecurity Plus Manageengine Device Control Plus Manageengine Endpoint Central Manageengine Endpoint Central Msp Manageengine Endpoint Dlp Plus Manageengine Exchange Reporter Plus Manageengine Firewall Analyzer Manageengine Log360 Ueba Manageengine M365 Manager Plus Manageengine M365 Security Plus Manageengine Mobile Device Manager Plus Manageengine Netflow Analyzer Manageengine Network Configuration Manager Manageengine Opmanager Manageengine Oputils Manageengine Os Deployer Manageengine Pam360 Manageengine Password Manager Pro Manageengine Patch Connect Plus Manageengine Patch Manager Plus Manageengine Recoverymanager Plus Manageengine Remote Access Plus Manageengine Remote Monitoring And Management Manageengine Secure Gateway Server Manageengine Servicedesk Plus Manageengine Servicedesk Plus Msp Manageengine Sharepoint Manager Plus Manageengine Supportcenter Plus Manageengine Vulnerability Manager Plus
Weaknesses

Sources

Status
PUBLISHED
Assigner
tenable
Published
Updated
Feb 13, 2025, 5:26 PM
Reserved
Nov 13, 2023, 3:10 PM
Status
Modified
Published
Nov 15, 2023, 9:15 PM
Modified
Jun 17, 2026, 6:50 AM