CVE-2023-6105: medium-severity vulnerability in ManageEngine Access Manager Plus
ManageEngine Information Disclosure in Multiple Products
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.7%
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
ManageEngine · Access Manager PlusManageEngine · Asset ExplorerManageEngine · Service Desk PlusRelated CVEs — ManageEngine Access Manager Plus
In the same product, most dangerous first.