← Back

CVE-2023-41904

nvd nist
Published: Sep 27, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: NVD

Description

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

Affected (4)

Zohocorp
1 product
Manageengine Admanager Plus
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Admanager Plus
Before 7.2
Manageengine Admanager Plus
Version 7.2 7200
Manageengine Admanager Plus
Version 7.2 7201
Manageengine Admanager Plus
Version 7.2 7202

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.