CVE-2024-36037 - OpenCVE

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.manageengine.com/products/active-directory-audit/cve-2024-36037.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: ManageEngine

Published: 2024-05-27T17:59:52.711Z

Updated: 2024-08-02T03:30:12.993Z

Reserved: 2024-05-17T19:23:57.540Z

Link: CVE-2024-36037

Vulnrichment

Updated: 2024-08-02T03:30:12.993Z

NVD

Status : Awaiting Analysis

Published: 2024-05-27T18:15:10.407

Modified: 2024-07-03T02:02:41.210

Link: CVE-2024-36037

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36037", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "ManageEngine", "dateReserved": "2024-05-17T19:23:57.540Z", "datePublished": "2024-05-27T17:59:52.711Z", "dateUpdated": "2024-08-02T03:30:12.993Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ADAudit Plus", "vendor": "ManageEngine", "versions": [{"lessThan": "7270", "status": "affected", "version": "0", "versionType": "7270"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings."}], "value": "Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "ManageEngine", "dateUpdated": "2024-05-31T10:20:51.780Z"}, "references": [{"url": "https://www.manageengine.com/products/active-directory-audit/cve-2024-36037.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Insufficient Access Control Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T17:29:49.203368Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:manageengine:adaudit_plus:*:*:*:*:*:*:*:*"], "vendor": "manageengine", "product": "adaudit_plus", "versions": [{"status": "affected", "version": "0", "lessThan": "7270", "versionType": "custom"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:59.677Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.993Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.manageengine.com/products/active-directory-audit/cve-2024-36037.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.manageengine.com/products/active-directory-audit/cve-2024-36037.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.993Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T17:29:49.203368Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:manageengine:adaudit_plus:*:*:*:*:*:*:*:*"], "vendor": "manageengine", "product": "adaudit_plus", "versions": [{"status": "affected", "version": "0", "lessThan": "7270", "versionType": "custom"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T17:34:45.750Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Insufficient Access Control Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ManageEngine", "product": "ADAudit Plus", "versions": [{"status": "affected", "version": "0", "lessThan": "7270", "versionType": "7270"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.manageengine.com/products/active-directory-audit/cve-2024-36037.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.", "supportingMedia": [{"type": "text/html", "value": "Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.", "base64": false}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "ManageEngine", "dateUpdated": "2024-05-31T10:20:51.780Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36037", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:30:12.993Z", "dateReserved": "2024-05-17T19:23:57.540Z", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "datePublished": "2024-05-27T17:59:52.711Z", "assignerShortName": "ManageEngine"}, "dataVersion": "5.1"}