CVE-2023-6105

high-risk

Published 2023-11-15

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Manageengine Analytics Plus

Manageengine Appcreator

Manageengine Application Control Plus

Manageengine Browser Security Plus

Manageengine Device Control Plus

Manageengine Endpoint Central

Manageengine Endpoint Central Msp

Manageengine Endpoint Dlp Plus

Manageengine Mobile Device Manager Plus

Manageengine Os Deployer

Manageengine Patch Manager Plus

Manageengine Remote Access Plus

Manageengine Remote Monitoring And Management

Manageengine Vulnerability Manager Plus

Manageengine Adselfservice Plus

Affected Vendors

Zohocorp

References (4)

https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html

Exploit https://www.tenable.com/security/research/tra-2023-35

https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html

Exploit https://www.tenable.com/security/research/tra-2023-35

/ 100

high-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 33/34 · Critical