CVE-2023-2291

Name of the Vulnerable Software and Affected Versions ManageEngine Access Manager Plus (AMP) build 4309 ManageEngine Password Manager Pro (affected versions not specified) ManageEngine PAM360 (affected versions not specified)

Description Static credentials exist in the PostgreSQL data used in the affected products. These credentials could allow a malicious actor to modify configuration data, escalating their permissions from a low-privileged user to an Administrative user.

Recommendations For ManageEngine Access Manager Plus (AMP) build 4309, update to a version that does not include static credentials in the PostgreSQL data. For ManageEngine Password Manager Pro, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ManageEngine PAM360, at the moment, there is no information about a newer version that contains a fix for this vulnerability.