CVE-2023-48646
Published: 22 November 2023
Summary
CVE-2023-48646 is a high-severity an unspecified weakness vulnerability in Zohocorp Manageengine Recoverymanager Plus. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Zoho ManageEngine RecoveryManager Plus versions prior to 6070 contain a vulnerability that permits admin users to execute arbitrary commands through the product's proxy settings. The flaw carries a CVSS 3.1 base score of 7.2 with network attack vector, low complexity, and high impact across confidentiality, integrity, and availability when exploited by a privileged user.
An authenticated administrator can leverage the proxy configuration interface to inject and run operating-system commands on the server, resulting in full control over the affected RecoveryManager Plus instance. No unauthenticated or user-interaction requirements are needed for successful exploitation.
The vendor advisory published at https://www.manageengine.com/ad-recovery-manager/advisory/CVE-2023-48646.html describes the issue and the corrective measures available to customers. The EPSS score reached a peak of 0.6515 and currently stands at 0.5414.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-52696
Vulnerability details
Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.