CVE-2024-38872: SQL Injection
Published Jul 26, 2024
·Updated
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module.
Affected Software
18 affected components
ZohoCorp ManageEngine Exchange Reporter Plus<5.7
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5700
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5701
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5702
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5703
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5704
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5705
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5706
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5707
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5708
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5709
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5710
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5711
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5712
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5713
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5714
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5715
ZohoCorp ManageEngine Exchange Reporter Plus=5.7-5717
Event History
Jul 26, 2024
CVE Published
via MITRE·05:30 PM
Data Sourced
via MITRE·05:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-38872?
CVE-2024-38872 is classified as a high-severity vulnerability due to its potential for authenticated SQL injection.
2
How do I fix CVE-2024-38872?
To mitigate CVE-2024-38872, upgrade to a patched version of Zohocorp ManageEngine Exchange Reporter Plus beyond version 5.7.
3
What versions of Zohocorp ManageEngine Exchange Reporter Plus are affected by CVE-2024-38872?
CVE-2024-38872 affects all versions of Zohocorp ManageEngine Exchange Reporter Plus 5.7 and below.
4
What is the impact of CVE-2024-38872 on systems?
The impact of CVE-2024-38872 includes potential unauthorized access to sensitive information through SQL injection in the monitoring module.
5
Is CVE-2024-38872 an authenticated attack vector?
Yes, CVE-2024-38872 requires an authenticated user to exploit the SQL injection vulnerability.