« Volver al listado

CVE-2024-36035

Estado: AnalizadaAlta (8.8)—

Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Adaudit Plus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-36035",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36035",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-12T13:47:27.828968Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "ManageEngine",
          "product": "ADAudit Plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "8110",
              "lessThanOrEqual": "8003"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "collectionURL": "https://www.manageengine.com/products/active-directory-audit/download.html",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:manageengine:adaudit_plus:*:*:*:*:*:*:*:*"
          ],
          "vendor": "manageengine",
          "product": "adaudit_plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8003",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-12T13:38:21.737",
  "references": [
    {
      "url": "https://www.manageengine.com/products/active-directory-audit/sqlfix-8003.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording."
    },
    {
      "lang": "es",
      "value": "Las versiones de Zohocorp ManageEngine ADAudit Plus inferiores a 8003 son vulnerables a la inyección SQL autenticada en la grabación de sesiones de usuario."
    }
  ],
  "lastModified": "2026-06-17T07:36:00.327",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0850887B-5218-4710-8A76-BB3E8BF855CE",
              "versionEndExcluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:8.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F629B2F2-94E2-4939-A98E-C0830CF69084"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:8.0:8000:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83A4D1E9-5C49-45E2-825B-D5B0A3A20C48"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:8.0:8001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "209257C4-7180-4773-A5B2-0528F70033AD"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:8.0:8002:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "516F7287-D04C-42EC-8709-3FFD0E314A3B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02"
}