CVE-2023-29084 Command injection in n/a
Authenticated attackers can execute arbitrary commands via Proxy settings in Zoho ManageEngine ADManager Plus.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29084?
CVE-2023-29084 is a high-severity command injection vulnerability in Zohocorp Manageengine Admanager Plus, published on 13 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
Weakness: CWE-77
Which versions are affected by CVE-2023-29084?
It affects 1 product.
Products include Zohocorp Manageengine Admanager Plus.
How do I fix CVE-2023-29084?
No fix has been published for CVE-2023-29084 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-29084 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-29084 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Zohocorp Manageengine Admanager Plus
Sources
Also known as GHSA-q6fm-vxc6-q2wj.