CVE-2024-21775

Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html	Vendor Advisory
https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus::::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:-::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5700::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5701::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5702::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5703::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5704::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5705::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5706::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5707::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5708::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5709::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5710::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5711::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5712::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5713::::::
	cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5714::::::

History

26 Nov 2024, 16:34

Type	Values Removed	Values Added
References	~~() https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html -~~	() https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html - Vendor Advisory
CPE		cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5712:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:-:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5708:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5702:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5705:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5700:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5710:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5703:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5701:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5714:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5707:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5713:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5704:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5709:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5711:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:::::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5706::::::
First Time		Zohocorp Zohocorp manageengine Exchange Reporter Plus
References	~~() https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html -~~	() https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html - Vendor Advisory
First Time		Zohocorp Zohocorp manageengine Exchange Reporter Plus
CPE		cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5712:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:-:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5708:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5702:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5705:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5700:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5710:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5703:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5701:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5714:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5707:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5713:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5704:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5709:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5711:::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:::::::: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.7:5706::::::

21 Nov 2024, 08:54

Type	Values Removed	Values Added
References	~~() https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html -~~	() https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html -

07 Jun 2024, 09:15

Type	Values Removed	Values Added
CWE		CWE-89
Summary	~~(en) Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.~~	(en) Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.

16 Feb 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-16 15:15

Updated : 2024-11-26 16:34

NVD link : CVE-2024-21775

Mitre link : CVE-2024-21775

CVE.ORG link : CVE-2024-21775

JSON object : View

Products Affected

zohocorp

manageengine_exchange_reporter_plus

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

8.3 /10