CVE-2020-9347
First published: Mon Mar 16 2020(Updated: )
** DISPUTED ** Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external application, and do not plan to add CSV constraints to their own products.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Password Manager Pro | =10.0 | |
| Zohocorp Manageengine Password Manager Pro | =10.0-build10001 | |
| Zohocorp Manageengine Password Manager Pro | =10.1-build10100 | |
| Zohocorp Manageengine Password Manager Pro | =10.1-build10101 | |
| Zohocorp Manageengine Password Manager Pro | =10.1-build10102 | |
| Zohocorp Manageengine Password Manager Pro | =10.1-build10103 | |
| Zohocorp Manageengine Password Manager Pro | =10.1-build10104 | |
| Zohocorp Manageengine Password Manager Pro | =10.2-build10200 | |
| Zohocorp Manageengine Password Manager Pro | =10.3-build10300 | |
| Zohocorp Manageengine Password Manager Pro | =10.3-build10301 | |
| Zohocorp Manageengine Password Manager Pro | =10.3-build10302 | |
| Zohocorp Manageengine Password Manager Pro | =10.4 | |
| Zohocorp Manageengine Password Manager Pro | =10.4-build10400 | |
| Zohocorp Manageengine Password Manager Pro | =10.4-build10401 | |
| Zohocorp Manageengine Password Manager Pro | =10.4-build10402 | |
| =10.0 | ||
| =10.0-build10001 | ||
| =10.1-build10100 | ||
| =10.1-build10101 | ||
| =10.1-build10102 | ||
| =10.1-build10103 | ||
| =10.1-build10104 | ||
| =10.2-build10200 | ||
| =10.3-build10300 | ||
| =10.3-build10301 | ||
| =10.3-build10302 | ||
| =10.4 | ||
| =10.4-build10400 | ||
| =10.4-build10401 | ||
| =10.4-build10402 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-9347.
What is the severity rating of CVE-2020-9347?
CVE-2020-9347 has a severity rating of 9.8 (Critical).
What is the affected software?
The affected software is Zoho ManageEngine Password Manager Pro versions 10.0 through 10.4.
How can this vulnerability be exploited?
This vulnerability can be exploited through a crafted name that is mishandled by the Export Passwords feature.
Is there a fix or mitigation available for this vulnerability?
At the time of this report, the vendor disputes the significance of this report, so there may not be an official fix or mitigation available.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/zohocorp
- canonical/zohocorp manageengine password manager pro
- version/zohocorp manageengine password manager pro/10.0
- version/zohocorp manageengine password manager pro/10.0-build10001
- version/zohocorp manageengine password manager pro/10.1-build10100
- version/zohocorp manageengine password manager pro/10.1-build10101
- version/zohocorp manageengine password manager pro/10.1-build10102
- version/zohocorp manageengine password manager pro/10.1-build10103
- version/zohocorp manageengine password manager pro/10.1-build10104
- version/zohocorp manageengine password manager pro/10.2-build10200
- version/zohocorp manageengine password manager pro/10.3-build10300
- version/zohocorp manageengine password manager pro/10.3-build10301
- version/zohocorp manageengine password manager pro/10.3-build10302
- version/zohocorp manageengine password manager pro/10.4
- version/zohocorp manageengine password manager pro/10.4-build10400
- version/zohocorp manageengine password manager pro/10.4-build10401
- version/zohocorp manageengine password manager pro/10.4-build10402