Versio.io

CVE-2020-9347

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 16-03-2020 11:15
Last modified: - 18-04-2022 04:29
Total changes: - 3

Description

** DISPUTED ** Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external application, and do not plan to add CSV constraints to their own products.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Low
Attack complexity
Network
Attack vector
High
Availability
High
Confidentiality
High
Integrity
None
Privileges required
Unchanged
Scope
None
User interaction
9.8
Base score
3.9
5.9
Exploitability score
Impact score
 

Verification logic

OR
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.0 AND update=-
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.0 AND update=build10001
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.1 AND update=build10100
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.1 AND update=build10101
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.1 AND update=build10102
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.1 AND update=build10103
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.1 AND update=build10104
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.2 AND update=build10200
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.3 AND update=build10300
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.3 AND update=build10301
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.3 AND update=build10302
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.4 AND update=-
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.4 AND update=build10400
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.4 AND update=build10401
vendor=zohocorp AND product=manageengine_password_manager_pro AND version=10.4 AND update=build10402
 

Reference

 


Keywords

NVD

 

CVE-2020-9347

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.