CVE-2020-9346

HIGH

ManageEngine Password Manager Pro <= 10.4 - Cross-Site Request Forgery

Title source: llm

Description

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory x_refsource_misc

https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html

Third Party Advisory x_refsource_misc

https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.4_CSRF.txt

Scores

CVSS v3 8.8

EPSS 0.0048

EPSS Percentile 65.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (2)

zohocorp/manageengine_password_manager_pro 10.4 (4 CPE variants)

zohocorp/manageengine_password_manager_pro < 10.4

Published Mar 16, 2020

Tracked Since Feb 18, 2026