CVE-2020-9347

Published: Mar 16, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external application, and do not plan to add CSV constraints to their own products

Affected (15)

Products: Zohocorp: Manageengine Password Manager Pro

Zohocorp

1 product

Manageengine Password Manager Pro

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Password Manager Pro	Version 10.0
Zohocorp Manageengine Password Manager Pro	Version 10.0 build10001
Zohocorp Manageengine Password Manager Pro	Version 10.1 build10100
Zohocorp Manageengine Password Manager Pro	Version 10.1 build10101
Zohocorp Manageengine Password Manager Pro	Version 10.1 build10102
Zohocorp Manageengine Password Manager Pro	Version 10.1 build10103
Zohocorp Manageengine Password Manager Pro	Version 10.1 build10104
Zohocorp Manageengine Password Manager Pro	Version 10.2 build10200
Zohocorp Manageengine Password Manager Pro	Version 10.3 build10300
Zohocorp Manageengine Password Manager Pro	Version 10.3 build10301
Zohocorp Manageengine Password Manager Pro	Version 10.3 build10302
Zohocorp Manageengine Password Manager Pro	Version 10.4
Zohocorp Manageengine Password Manager Pro	Version 10.4 build10400
Zohocorp Manageengine Password Manager Pro	Version 10.4 build10401
Zohocorp Manageengine Password Manager Pro	Version 10.4 build10402

Related CWEs

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.x_CSV_Excel_Macro_Injection.txt

Source: cve@mitre.org

Third Party Advisory

https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.x_CSV_Excel_Macro_Injection.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.