CVE-2023-6105

ManageEngine Information Disclosure in Multiple Products

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Affected

ManageEngine · Service Desk Plus · Asset Explorer · Access Manager Plus

CVSS v3.1 NVD

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.69% chance of exploitation in the next 30 days, 52nd percentile

Published

2023-11-15

Updated

2025-02-13

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2023-35

References

• CVE Record
• NVD entry