CVE-2024-36036: Insufficient Access Control Vulnerability

Description

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent configuration.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 31% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AP

ADAudit Plus · ManageEngine

before 7270 · source: vendor

MA

Manageengine Adaudit Plus · Zohocorp

before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +8 more · source: NVD