ZDI-23-1719: ManageEngine Recovery Manager Plus getEscapedValue Command Injection Remote Code Execution Vulnerability
Published Nov 22, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Recovery Manager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2023-48646.
Affected Software
1 affected component
ManageEngine Recovery Manager Plus
Event History
Nov 22, 2023
Advisory Published
06:00 AM
Data Sourced
06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-23-1719?
The severity of ZDI-23-1719 is rated at 7.2 according to the CVSS scoring system.
2
How do I fix ZDI-23-1719?
To fix ZDI-23-1719, apply the latest security patches provided by ManageEngine for Recovery Manager Plus.
3
What type of vulnerability is ZDI-23-1719?
ZDI-23-1719 is a remote code execution vulnerability that requires authentication to exploit.
4
Which software is affected by ZDI-23-1719?
ZDI-23-1719 affects ManageEngine Recovery Manager Plus.
5
Is authentication required to exploit ZDI-23-1719?
Yes, authentication is required to exploit the ZDI-23-1719 vulnerability.