CVE-2023-6105

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

CVSS v3.1

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.69% chance of exploitation in the next 30 days, 50th percentile

Published

2023-11-15

Updated

2025-02-13

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2023-35

References

• CVE Record
• NVD entry

Related

• CVE-2023-6103
• CVE-2023-6111
• CVE-2023-6099
• CVE-2023-6113
• CVE-2023-6084
• CVE-2023-6114