Exposed dangerous method or function in ManageEngine Analytics Plus - CVE-2024-52323
Published: December 12, 2024
Vulnerability identifier: #VU101747
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-52323
CWE-ID: CWE-749
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to exposed dangerous method or function within the implementation of the getOAToken action, which leads to security restrictions bypass and privilege escalation.
Affected software
ManageEngine Analytics Plus
How to mitigate CVE-2024-52323
Install updates from vendor's website.
ManageEngine Analytics Plus - update to 6100