CVE-2020-9346

Published: Mar 16, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.

Affected (5)

Products: Zohocorp: Manageengine Password Manager Pro

Zohocorp

1 product

Manageengine Password Manager Pro

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Password Manager Pro	Before 10.4
Zohocorp Manageengine Password Manager Pro	Version 10.4
Zohocorp Manageengine Password Manager Pro	Version 10.4 build10400
Zohocorp Manageengine Password Manager Pro	Version 10.4 build10401
Zohocorp Manageengine Password Manager Pro	Version 10.4 build10402