CVE-2020-9346

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro versions 10.4 and prior

Description The issue concerns a lack of protection against Cross-site Request Forgery (CSRF) attacks. This can be demonstrated by an attacker changing a user's role.

Recommendations For Zoho ManageEngine Password Manager Pro versions 10.4 and prior, consider implementing additional security measures to protect against CSRF attacks, such as validating request tokens, until a patch is available. As a temporary workaround, restrict access to sensitive user management functions to minimize the risk of exploitation.