CVE-2023-2291 Hardcoded credentials in Zoho ManageEngine Multiple Products

High 7.8 Published 26 Apr 2023 Updated 3 Feb 2025

Hardcoded PostgreSQL credentials allow low-privileged users to escalate to administrative access and modify configuration data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-2291?

CVE-2023-2291 is a high-severity vulnerability in Zoho ManageEngine Multiple Products, published on 26 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.

Weakness: CWE-798

Which versions are affected by CVE-2023-2291?

It affects 3 products.

Products include Zohocorp Manageengine Access Manager Plus, Zohocorp Manageengine Pam360, Zohocorp Manageengine Password Manager Pro.

How do I fix CVE-2023-2291?

No fix has been published for CVE-2023-2291 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2291 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2291 exists.

Sources

Also known as GHSA-q9gm-gx3j-8hmm.