PT-2024-5582
CVE-2024-38871
·
تاريخ النشر
2024-07-15
·
تاريخ التحديث
2024-09-11
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ManageEngine Exchange Reporter Plus versions 5717 and below
Description
The issue is related to the lack of protection against SQL query structure attacks in the reports module of ManageEngine Exchange Reporter Plus. This can allow a remote attacker to execute arbitrary SQL queries to the database. The exploitation of this issue is possible through authenticated SQL injection in the reports module.
Recommendations
For versions 5717 and below, update to a version above 5717 to resolve the issue.
As a temporary workaround, consider restricting access to the reports module until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾