Disclosure of default passwords for account restoration to authenticated technicians - ManageEngine ADManager Plus

Vulnerability Details
Severity	Medium
CVE ID	CVE-2023-31492
Affected software versions	7182 and older
Fixed version	7183
Fixed on	Mar. 15, 2023

Details

ADManager Plus builds 7182 and older are reported to have a security vulnerability that allows authenticated technicians to view the default passwords for the account restoration of unauthorized domains. This has been fixed in the build 7183; its release notes can be found here.

Impact

Authenticated technicians can view the default passwords intended for account restoration of non-delegated domains by constructing a specific API request.

Steps to update

Update your ADManager Plus instance to its latest build by installing the service pack.

Acknowledgement

This issue was reported by metin via Zoho's Bug Bounty program.

Select a language to translate the contents of this web page:

Need further assistance?

Fill this form, and we'll contact you rightaway.

Request Support

"Thank you for submitting your request.

Our technical support team will get in touch with you at the earliest."