1. Home
  2. CVE Database
  3. CVE-2023-2291
HIGH · 7.8

CVE-2023-2291

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a m...

Vulnerability Description

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ZohocorpManageengine Access Manager Plus4.3
ZohocorpManageengine Pam360All versions
ZohocorpManageengine Password Manager ProAll versions

Related Weaknesses (CWE)

CWE-798

References

FAQ

What is CVE-2023-2291?

CVE-2023-2291 is a vulnerability with a CVSS score of 7.8 (HIGH). Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a m...

How severe is CVE-2023-2291?

CVE-2023-2291 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-2291?

Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Access Manager Plus, Zohocorp Manageengine Pam360, Zohocorp Manageengine Password Manager Pro.