CVE-2023-6105

MEDIUM

ManageEngine - Info Disclosure

Title source: llm

Description

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

References (2)

[Exploit, Third Party Advisory] https://www.tenable.com/security/research/tra-2023-35

[Vendor Advisory] https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html

Scores

CVSS v3 5.5

EPSS 0.0008

EPSS Percentile 24.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (50)

zohocorp/manageengine_analytics_plus < 5.3

zohocorp/manageengine_appcreator < 2.0.0

zohocorp/manageengine_application_control_plus < 11.2.2328.01

zohocorp/manageengine_browser_security_plus < 11.2.2328.01

zohocorp/manageengine_device_control_plus < 11.2.2328.01

zohocorp/manageengine_endpoint_central < 11.2.2322.01

zohocorp/manageengine_endpoint_central_msp < 11.2.2322.01

zohocorp/manageengine_endpoint_dlp_plus < 11.2.2328.01

zohocorp/manageengine_mobile_device_manager_plus < 10.1.2204.2

zohocorp/manageengine_mobile_device_manager_plus

zohocorp/manageengine_os_deployer < 1.2.2331.1

zohocorp/manageengine_patch_manager_plus < 11.2.2328.01

zohocorp/manageengine_remote_access_plus < 11.2.2328.01

zohocorp/manageengine_remote_monitoring_and_management < 10.2.11

zohocorp/manageengine_vulnerability_manager_plus < 11.2.2328.01

... and 35 more

Timeline

Published Nov 15, 2023

Tracked Since Feb 18, 2026