CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2020-03-16

Last modified

2024-08-04

Weaknesses

CWE-352

Affected products

• Manageengine Password Manager Pro (Zohocorp)

References

• https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.4_CSRF.txt
• https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html