« Volver al listado

CVE-2024-21791

Estado: AnalizadaAlta (7.2)—

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Adaudit Plus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-21791",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21791",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-22T18:36:46.444325Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "ManageEngine",
          "product": "ADAudit Plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7271",
              "versionType": "7271"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-22T18:15:09.740",
  "references": [
    {
      "url": "https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    },
    {
      "url": "https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. \nNote: Non-admin users cannot exploit this vulnerability."
    },
    {
      "lang": "es",
      "value": "Las versiones de Zoho ManageEngine ADAudit Plus inferiores a 7271 permiten la inyección SQL en la opción del historial de bloqueo. Nota: Los usuarios que no sean administradores no pueden aprovechar esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:10:10.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E802FD77-E67A-438C-82CE-9FC7536FB14E",
              "versionEndExcluding": "7.2"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7200:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FAF63F4-AED2-4EA4-BA5B-45961B2E29B2"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7201:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "237AA2F5-B9A3-4C40-92AC-61FE47A017BC"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7202:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C23A64C-65CB-447B-9B5F-4BB22F68FC79"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7203:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3489D84B-5960-4FA7-A2DD-88AE35C34CE6"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7210:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D86AB1CC-0FDE-4CC1-BF64-E0C61EAF652F"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7211:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "076FDAE7-9DB2-4A04-B09E-E53858D208C7"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7212:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07C08B57-FA76-4E24-BC10-B837597BC7E0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7213:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D734ACB-33E8-4315-8A79-2B97CE1D0509"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7215:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9314CA98-7A69-4D2B-9928-40F55888C9FF"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7220:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCE7999C-D6AE-4406-A563-A520A171381D"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7250:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5716895-4553-4613-B774-0964D3E88AA0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7251:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C40A093F-C442-4B05-8746-B533DE0683A3"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7260:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "562563FC-DBAD-441C-B01A-796AFB67DA0D"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7270:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "094FB6FD-1ADF-4583-91D4-94A9B6395AD2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02"
}