CVE-2023-6105

MEDIUM 5.5CVE-2023-6105 · Published 15/11/2023 · updated 17/06/2026

In short

CVE-2023-6105 is a MEDIUM (CVSS 5.5) vulnerability affecting manageengine access manager plus (zohocorp), manageengine adaudit plus (zohocorp), manageengine admanager plus (zohocorp).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.9% of all vulnerabilities.
Fix: update to 4.3, 7.2, 6.3, 5.3 or later.

Package	Affected versions	Patched versions
manageengine access manager plus zohocorp	`= 4.3< 4.3`	`4.3`
manageengine adaudit plus zohocorp	`= 7.2< 7.2`	`7.2`
manageengine admanager plus zohocorp	`= 7.2< 7.2`	`7.2`
manageengine adselfservice plus zohocorp	`= 6.3< 6.3`	`6.3`
manageengine analytics plus zohocorp	`< 5.3`	`5.3`
manageengine appcreator zohocorp	`< 2.0.0`	`2.0.0`
manageengine application control plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`
manageengine assetexplorer zohocorp	`= 7.0< 7.0`	`7.0`
manageengine browser security plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`
manageengine cloud security plus zohocorp	`= 4.1< 4.1`	`4.1`
manageengine datasecurity plus zohocorp	`= 6.1< 6.1`	`6.1`
manageengine device control plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`
manageengine endpoint central zohocorp	`< 11.2.2322.01`	`11.2.2322.01`
manageengine endpoint central msp zohocorp	`< 11.2.2322.01`	`11.2.2322.01`
manageengine endpoint dlp plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`
manageengine exchange reporter plus zohocorp	`= 5.7< 5.7`	`5.7`
manageengine firewall analyzer zohocorp	`= 12.5= 12.7< 12.5< 12.7`	`12.512.7`
manageengine log360 ueba zohocorp	`= 4.0< 4.0`	`4.0`
manageengine m365 manager plus zohocorp	`= 4.5< 4.5`	`4.5`
manageengine m365 security plus zohocorp	`= 4.5< 4.5`	`4.5`
manageengine mobile device manager plus zohocorp	`= 10.1.2207.4< 10.1.2204.2`	`10.1.2204.2`
manageengine netflow analyzer zohocorp	`= 12.5= 12.7< 12.5< 12.7`	`12.512.7`
manageengine network configuration manager zohocorp	`= 12.5= 12.7< 12.5< 12.7`	`12.512.7`
manageengine opmanager zohocorp	`= 12.5= 12.7< 12.5< 12.7`	`12.512.7`
manageengine oputils zohocorp	`= 12.5= 12.7< 12.5< 12.7`	`12.512.7`
manageengine os deployer zohocorp	`< 1.2.2331.1`	`1.2.2331.1`
manageengine pam360 zohocorp	`< 5.7`	`5.7`
manageengine password manager pro zohocorp	`< 12.3`	`12.3`
manageengine patch connect plus zohocorp	`= 9.0.0`	No fix yet
manageengine patch manager plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`
manageengine recoverymanager plus zohocorp	`= 6.0< 6.0`	`6.0`
manageengine remote access plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`
manageengine remote monitoring and management zohocorp	`< 10.2.11`	`10.2.11`
manageengine secure gateway server zohocorp	`= 9.0< 9.0`	`9.0`
manageengine servicedesk plus zohocorp	`= 14.3< 14.3`	`14.3`
manageengine servicedesk plus msp zohocorp	`= 14.3< 14.3`	`14.3`
manageengine sharepoint manager plus zohocorp	`= 4.4< 4.4`	`4.4`
manageengine supportcenter plus zohocorp	`= 14.3< 14.3`	`14.3`
manageengine vulnerability manager plus zohocorp	`< 11.2.2328.01`	`11.2.2328.01`

Description

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

References

More vulnerabilities in manageengine access manager plus

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free