Privilege escalation in Zoho Corporation Password Manager Pro

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU84519

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions. A local user can unauthorized access to the system and perform actions, such as deleting the IIS binding, triggering certificate discovery, rotating unknown SSH keys, in a key grooup, etc.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Password Manager Pro: before 12310

External links

http://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp12310

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.