CVE-2022-24978: High severity zoho manageengine adaudit plus vulnerability
Published Apr 5, 2022
·Updated
Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response.
Affected Software
14 affected components
ZohoCorp ManageEngine ADAudit Plus<=6.0
ZohoCorp ManageEngine ADAudit Plus=7.0-7000
ZohoCorp ManageEngine ADAudit Plus=7.0-7002
ZohoCorp ManageEngine ADAudit Plus=7.0-7003
ZohoCorp ManageEngine ADAudit Plus=7.0-7004
ZohoCorp ManageEngine ADAudit Plus=7.0-7005
ZohoCorp ManageEngine ADAudit Plus=7.0-7006
ZohoCorp ManageEngine ADAudit Plus=7.0-7007
ZohoCorp ManageEngine ADAudit Plus=7.0-7008
ZohoCorp ManageEngine ADAudit Plus=7.0-7050
ZohoCorp ManageEngine ADAudit Plus=7.0-7051
ZohoCorp ManageEngine ADAudit Plus=7.0-7052
ZohoCorp ManageEngine ADAudit Plus=7.0-7053
ZohoCorp ManageEngine ADAudit Plus=7.0-7054
Remediation
Event History
Apr 5, 2022
CVE Published
via MITRE·06:24 PM
Data Sourced
via MITRE·06:24 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-24978.
2
What is the severity level of CVE-2022-24978?
The severity level of CVE-2022-24978 is high.
3
How does CVE-2022-24978 allow authenticated Privilege Escalation on Integrated products?
CVE-2022-24978 allows authenticated Privilege Escalation on Integrated products because a password field is present in a JSON response.
4
Which version of Zoho ManageEngine ADAudit Plus is affected by CVE-2022-24978?
Zoho ManageEngine ADAudit Plus versions up to 6.0 and versions 7.0-7000 to 7.0-7054 are affected by CVE-2022-24978.
5
How can I fix CVE-2022-24978?
To fix CVE-2022-24978, it is recommended to upgrade to a patched version of Zoho ManageEngine ADAudit Plus.