CVE-2024-41140
Published: 29 January 2025
Summary
CVE-2024-41140 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Zohocorp Manageengine Applications Manager. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 34.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-41140 is an incorrect authorization vulnerability (CWE-863) in the update user function of Zohocorp ManageEngine Applications Manager versions 174000 and prior. Published on 2025-01-29, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts.
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact unauthorized access to confidentiality and integrity, such as modifying user data, while leaving availability unaffected and scope unchanged.
ManageEngine has published a security update advisory addressing this issue, available at https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-41140.html, which security practitioners should consult for patch details and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38917
Vulnerability details
Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect authorization in update-user function directly enables low-priv authenticated attackers to modify accounts (T1098 Account Manipulation) and thereby escalate privileges (T1068 Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and correcting the specific authorization flaw in the update user function through timely patching.
Enforces approved authorizations to prevent low-privilege authenticated attackers from exploiting the incorrect authorization in the update user function.
Limits potential impact by restricting low-privilege users to only necessary access, reducing the scope of unauthorized modifications enabled by the flaw.