CVE-2023-6105: ManageEngine Information Disclosure in Multiple Products

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-15 · updated 2026-06-17
Weakness: CWE-200

Description

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

Affected products

Zohocorp ManageEngine Access Manager Plus: before 4.3; 4.3-build4300, 4.3-build4301, 4.3-build4302, 4.3-build4303, 4.3-build4304, 4.3-build4305 (+4) — fixed in 4.3
ManageEngine ADAudit Plus: before 7.2; 7.2-7200, 7.2-7201, 7.2-7202, 7.2-7203, 7.2-7210, 7.2-7211 (+5) — fixed in 7.2
Zohocorp ManageEngine ADManager Plus: before 7.2; 7.2-7200, 7.2-7201, 7.2-7202, 7.2-7203 — fixed in 7.2
ManageEngine ADSelfService Plus: before 6.3; 6.3-6300, 6.3-6301, 6.3-6302, 6.3-6303 — fixed in 6.3
ManageEngine Analytics Plus: before 5.3 — fixed in 5.3
Zohocorp Manageengine Appcreator: before 2.0.0 — fixed in 2.0.0
Zohocorp Manageengine Application Control Plus: before 11.2.2328.01 — fixed in 11.2.2328.01
Manage Engine Asset Explorer Agent: before 7.0; 7.0-7000, 7.0-7001, 7.0-7002, 7.0-7003, 7.0-7004 — fixed in 7.0
Zohocorp Manageengine Browser Security Plus: before 11.2.2328.01 — fixed in 11.2.2328.01
Zohocorp Manageengine Cloud Security Plus: before 4.1; 4.1-4100, 4.1-4101, 4.1-4102, 4.1-4103, 4.1-4104, 4.1-4105 (+24) — fixed in 4.1
Zohocorp ManageEngine DataSecurity Plus: before 6.1; 6.1-6100, 6.1-6101, 6.1-6110, 6.1-6111, 6.1-6120, 6.1-6121 (+1) — fixed in 6.1
Zohocorp Manageengine Device Control Plus: before 11.2.2328.01 — fixed in 11.2.2328.01
Zohocorp ManageEngine Endpoint Central: before 11.2.2322.01 — fixed in 11.2.2322.01
Zohocorp Manageengine Endpoint Central Msp: before 11.2.2322.01 — fixed in 11.2.2322.01
Zohocorp Manageengine Endpoint Dlp Plus: before 11.2.2328.01 — fixed in 11.2.2328.01
Zohocorp ManageEngine Exchange Reporter Plus: before 5.7; 5.7-5700, 5.7-5701, 5.7-5702, 5.7-5703, 5.7-5704, 5.7-5705 (+7) — fixed in 5.7
Zohocorp ManageEngine Firewall Analyzer: before 12.5; before 12.7; 12.5-build125000, 12.5-build125003, 12.5-build125108, 12.5-build125109, 12.5-build125115, 12.5-build125120 (+49) — fixed in 12.5, 12.7
Zohocorp Manageengine Log360 Ueba: before 4.0; 4.0-build4010, 4.0-build4011, 4.0-build4015, 4.0-build4016, 4.0-build4020, 4.0-build4021 (+17) — fixed in 4.0
Zohocorp ManageEngine M365 Manager Plus: before 4.5; 4.5-build4500, 4.5-build4502, 4.5-build4503, 4.5-build4504, 4.5-build4505, 4.5-build4507 (+24) — fixed in 4.5
Zohocorp ManageEngine M365 Security Plus: before 4.5; 4.5-4500, 4.5-4502, 4.5-4503, 4.5-4504, 4.5-4505, 4.5-4507 (+24) — fixed in 4.5
Zohocorp Manageengine Mobile Device Manager Plus: before 10.1.2204.2; 10.1.2207.4 — fixed in 10.1.2204.2
Zohocorp ManageEngine NetFlow Analyzer: before 12.5; before 12.7; 12.5-build125000, 12.5-build125108, 12.5-build125109, 12.5-build125115, 12.5-build125120, 12.5-build125122 (+55) — fixed in 12.5, 12.7
Zohocorp ManageEngine Network Configuration Manager: before 12.5; before 12.7; 12.5-build125000, 12.5-build125108, 12.5-build125112, 12.5-build125115, 12.5-build125116, 12.5-build125120 (+53) — fixed in 12.5, 12.7
Zohocorp ManageEngine OpManager: before 12.5; before 12.7; 12.5-build125000, 12.5-build125002, 12.5-build125100, 12.5-build125101, 12.5-build125102, 12.5-build125108 (+183) — fixed in 12.5, 12.7
Zohocorp ManageEngine OpUtils: before 12.5; before 12.7; 12.5-build125000, 12.5-build125108, 12.5-build125119, 12.5-build125120, 12.5-build125125, 12.5-build125129 (+44) — fixed in 12.5, 12.7
Zohocorp Manageengine Os Deployer: before 1.2.2331.1 — fixed in 1.2.2331.1
Zohocorp ManageEngine PAM360: before 5.7 — fixed in 5.7
Zohocorp ManageEngine Password Manager Pro: before 12.3 — fixed in 12.3
Zohocorp Manageengine Patch Connect Plus: 9.0.0-build90001, 9.0.0-build90063, 9.0.0-build90064, 9.0.0-build90065, 9.0.0-build90066, 9.0.0-build90067 (+56)
Zohocorp Manageengine Patch Manager Plus: before 11.2.2328.01 — fixed in 11.2.2328.01

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine Access Manager Plus 4.3; ManageEngine ADAudit Plus 7.2; Zohocorp ManageEngine ADManager Plus 7.2; ManageEngine ADSelfService Plus 6.3; ManageEngine Analytics Plus 5.3; Zohocorp Manageengine Appcreator 2.0.0; Zohocorp Manageengine Application Control Plus 11.2.2328.01; Manage Engine Asset Explorer Agent 7.0; Zohocorp Manageengine Browser Security Plus 11.2.2328.01; Zohocorp Manageengine Cloud Security Plus 4.1; Zohocorp ManageEngine DataSecurity Plus 6.1; Zohocorp Manageengine Device Control Plus 11.2.2328.01. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6105 or the next vulnerability affects your stack