CVE-2022-24446
First published: Tue Mar 01 2022(Updated: )
An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Key Manager Plus | =6.1.6 | |
| Zohocorp Manageengine Key Manager Plus | =6.1.6-build6100 | |
| Zohocorp Manageengine Key Manager Plus | =6.1.6-build6150 | |
| Zohocorp Manageengine Key Manager Plus | =6.1.6-build6151 | |
| Zohocorp Manageengine Key Manager Plus | =6.1.6-build6160 | |
| Zohocorp Manageengine Key Manager Plus | =6.1.6-build6161 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-24446?
CVE-2022-24446 is a vulnerability discovered in Zoho ManageEngine Key Manager Plus 6.1.6 that allows users with the level Operator to see all SSH servers and user information, even if no SSH server or user is associated with the operator.
How severe is CVE-2022-24446?
CVE-2022-24446 has a severity rating of 4.3, which is classified as medium severity.
What is the affected software version of CVE-2022-24446?
CVE-2022-24446 affects Zoho ManageEngine Key Manager Plus version 6.1.6.
How can I fix CVE-2022-24446?
To fix CVE-2022-24446, it is recommended to update Zoho ManageEngine Key Manager Plus to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2022-24446?
For more information about CVE-2022-24446, you can visit the following references: [Reference 1](https://excellium-services.com/cert-xlm-advisory/cve-2022-24446/) and [Reference 2](https://www.manageengine.com/key-manager/release-notes.html#6200).
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/event
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zohocorp
- canonical/zohocorp manageengine key manager plus
- version/zohocorp manageengine key manager plus/6.1.6
- version/zohocorp manageengine key manager plus/6.1.6-build6100
- version/zohocorp manageengine key manager plus/6.1.6-build6150
- version/zohocorp manageengine key manager plus/6.1.6-build6151
- version/zohocorp manageengine key manager plus/6.1.6-build6160
- version/zohocorp manageengine key manager plus/6.1.6-build6161