CVE-2020-9347: Critical severity ZohoCorp ManageEngine Password Manager Pro vulnerability
DISPUTED Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external application, and do not plan to add CSV constraints to their own products.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-9347.
What is the severity rating of CVE-2020-9347?
CVE-2020-9347 has a severity rating of 9.8 (Critical).
What is the affected software?
The affected software is Zoho ManageEngine Password Manager Pro versions 10.0 through 10.4.
How can this vulnerability be exploited?
This vulnerability can be exploited through a crafted name that is mishandled by the Export Passwords feature.
Is there a fix or mitigation available for this vulnerability?
At the time of this report, the vendor disputes the significance of this report, so there may not be an official fix or mitigation available.