CVE-2023-6105: Zohocorp ManageEngine Access Manager Plus

Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Affected products

  • Zohocorp ManageEngine Access Manager Plus: before 4.3 (fixed in 4.3); version 4.3 only
  • Zohocorp ManageEngine Adaudit Plus: before 7.2 (fixed in 7.2); version 7.2 only
  • Zohocorp ManageEngine Admanager Plus: before 7.2 (fixed in 7.2); version 7.2 only
  • Zohocorp ManageEngine Adselfservice Plus: before 6.3 (fixed in 6.3); version 6.3 only
  • Zohocorp ManageEngine Analytics Plus: before 5.3 (fixed in 5.3)
  • Zohocorp ManageEngine Appcreator: before 2.0.0 (fixed in 2.0.0)
  • Zohocorp ManageEngine Application Control Plus: before 11.2.2328.01 (fixed in 11.2.2328.01)
  • Zohocorp ManageEngine Assetexplorer: before 7.0 (fixed in 7.0); version 7.0 only
  • Zohocorp ManageEngine Browser Security Plus: before 11.2.2328.01 (fixed in 11.2.2328.01)
  • Zohocorp ManageEngine Cloud Security Plus: before 4.1 (fixed in 4.1); version 4.1 only
  • Zohocorp ManageEngine Datasecurity Plus: before 6.1 (fixed in 6.1); version 6.1 only
  • Zohocorp ManageEngine Device Control Plus: before 11.2.2328.01 (fixed in 11.2.2328.01)
  • Zohocorp ManageEngine Endpoint Central: before 11.2.2322.01 (fixed in 11.2.2322.01)
  • Zohocorp ManageEngine Endpoint Central Msp: before 11.2.2322.01 (fixed in 11.2.2322.01)
  • Zohocorp ManageEngine Endpoint Dlp Plus: before 11.2.2328.01 (fixed in 11.2.2328.01)
  • Zohocorp ManageEngine Exchange Reporter Plus: before 5.7 (fixed in 5.7); version 5.7 only
  • Zohocorp ManageEngine Firewall Analyzer: before 12.5 (fixed in 12.5); version 12.5 only; before 12.7 (fixed in 12.7); version 12.7 only
  • Zohocorp ManageEngine LOG360 Ueba: before 4.0 (fixed in 4.0); version 4.0 only
  • Zohocorp ManageEngine m365 Manager Plus: before 4.5 (fixed in 4.5); version 4.5 only
  • Zohocorp ManageEngine m365 Security Plus: before 4.5 (fixed in 4.5); version 4.5 only
  • Zohocorp ManageEngine Mobile Device Manager Plus: before 10.1.2204.2 (fixed in 10.1.2204.2); version 10.1.2207.4 only
  • Zohocorp ManageEngine Netflow Analyzer: before 12.5 (fixed in 12.5); version 12.5 only; before 12.7 (fixed in 12.7); version 12.7 only
  • Zohocorp ManageEngine Network Configuration Manager: before 12.5 (fixed in 12.5); version 12.5 only; before 12.7 (fixed in 12.7); version 12.7 only
  • Zohocorp ManageEngine Opmanager: before 12.5 (fixed in 12.5); version 12.5 only; before 12.7 (fixed in 12.7); version 12.7 only
  • Zohocorp ManageEngine Oputils: before 12.5 (fixed in 12.5); version 12.5 only; before 12.7 (fixed in 12.7); version 12.7 only
  • and 14 more

Published 2023-11-15. Last modified 2026-06-17.