vendor:
ADManager Plus
by:
Metin Yunus Kandemir
5.1
CVSS
MEDIUM
Password Disclosure
200
CWE
Product Name: ADManager Plus
Affected Version From: Build < 7183
Affected Version To: Build 7182
Patch Exists: YES
Related CWE: CVE-2023-31492
CPE: a:manageengine:admanager_plus:7182
Platforms Tested:
2023
ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure
The vulnerability exists in ManageEngine ADManager Plus Build version less than 7183, allowing helpdesk technicians without backup/recovery privileges to view and compromise user account passwords through password spraying attacks in Active Directory.
Mitigation:
Upgrade to version 7183 or higher to mitigate this vulnerability.
