Advisory Details

December 11th, 2024

ManageEngine Analytics Plus getOAToken Exposed Dangerous Method Privilege Escalation Vulnerability

CVE ID	CVE-2024-52323
CVSS SCORE	8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	ManageEngine
AFFECTED PRODUCTS	Analytics Plus
VULNERABILITY DETAILS	This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine Analytics Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the getOAToken action. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
ADDITIONAL DETAILS	ManageEngine has issued an update to correct this vulnerability. More details can be found at: https://www.manageengine.com/analytics-plus/CVE-2024-52323.html
DISCLOSURE TIMELINE	2024-11-05 - Vulnerability reported to vendor 2024-12-11 - Coordinated public release of advisory 2024-12-11 - Advisory Updated
CREDIT	Mohamed Mekkawy

BACK TO ADVISORIES