Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.

CVE-2023-31492 · published 3 years ago
Summary

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.

What to do
  • Update zohocorp manageengine_admanager_plus to version 7.1 or later.
Affected software
VendorProductAffected versions
zohocorp manageengine_admanager_plus < 7.1
7.1
cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*
Original advisory text
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
8% chance of attack within 30 days
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published17 Aug 2023
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2023-31492 · NVD
Track software like this
Free during beta