CVE-2024-27312 - OpenCVE

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Manageengine	Pam360

No data.

No data.

References

Link	Providers
https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html

History

Mon, 07 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Manageengine Manageengine pam360
CPEs		cpe:2.3:a:manageengine:pam360:660q:::::::*
Vendors & Products		Manageengine Manageengine pam360
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 07 Oct 2024 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-862

Mon, 07 Oct 2024 12:00:00 +0000

Type	Values Removed	Values Added
Description	Zoho ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability.	Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability.
Title	Authorization Vulnerability	Authorization vulnerability in PAM360
Weaknesses		CWE-863

MITRE

Status: PUBLISHED

Assigner: ManageEngine

Published: 2024-05-20T12:38:26.180Z

Updated: 2024-10-07T11:45:01.627Z

Reserved: 2024-02-23T06:13:18.186Z

Link: CVE-2024-27312

Vulnrichment

Updated: 2024-08-02T00:28:00.339Z

NVD

Status : Awaiting Analysis

Published: 2024-05-20T13:15:23.773

Modified: 2024-10-07T12:15:12.563

Link: CVE-2024-27312

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27312", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "ManageEngine", "dateReserved": "2024-02-23T06:13:18.186Z", "datePublished": "2024-05-20T12:38:26.180Z", "dateUpdated": "2024-10-07T11:45:01.627Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PAM360", "vendor": "ManageEngine", "versions": [{"lessThan": "6602", "status": "affected", "version": "6601", "versionType": "6601"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. <br>Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability.</span><br>"}], "value": "Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. \nNote: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "ManageEngine", "dateUpdated": "2024-10-07T11:45:01.627Z"}, "references": [{"url": "https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Authorization vulnerability in PAM360", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "manageengine", "product": "pam360", "cpes": ["cpe:2.3:a:manageengine:pam360:660q:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "660q", "status": "affected", "lessThan": "6601", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-20T14:15:20.342335Z", "id": "CVE-2024-27312", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-13T15:53:35.964Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:28:00.339Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:28:00.339Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27312", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-20T14:15:20.342335Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:manageengine:pam360:660q:*:*:*:*:*:*:*"], "vendor": "manageengine", "product": "pam360", "versions": [{"status": "affected", "version": "660q", "lessThan": "6601", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-20T14:21:59.574Z"}}], "cna": {"title": "Authorization vulnerability in PAM360", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ManageEngine", "product": "PAM360", "versions": [{"status": "affected", "version": "6601", "lessThan": "6602", "versionType": "6601"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. \nNote: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. <br>Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "ManageEngine", "dateUpdated": "2024-10-07T11:45:01.627Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27312", "state": "PUBLISHED", "dateUpdated": "2024-10-07T11:45:01.627Z", "dateReserved": "2024-02-23T06:13:18.186Z", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "datePublished": "2024-05-20T12:38:26.180Z", "assignerShortName": "ManageEngine"}, "dataVersion": "5.1"}