Cyber Posture

CVE-2024-41140

High

Published: 29 January 2025

Published
29 January 2025
Modified
29 September 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0015 34.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-41140 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Zohocorp Manageengine Applications Manager. Its CVSS base score is 8.1 (High).

Operationally, ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the CVE by identifying, reporting, and correcting the specific authorization flaw in the update user function through timely patching.

prevent

Enforces approved authorizations to prevent low-privilege authenticated attackers from exploiting the incorrect authorization in the update user function.

prevent

Limits potential impact by restricting low-privilege users to only necessary access, reducing the scope of unauthorized modifications enabled by the flaw.

NVD Description

Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.

Deeper analysisAI

CVE-2024-41140 is an incorrect authorization vulnerability (CWE-863) in the update user function of Zohocorp ManageEngine Applications Manager versions 174000 and prior. Published on 2025-01-29, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts.

The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact unauthorized access to confidentiality and integrity, such as modifying user data, while leaving availability unaffected and scope unchanged.

ManageEngine has published a security update advisory addressing this issue, available at https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-41140.html, which security practitioners should consult for patch details and mitigation guidance.

Details

CWE(s)

Affected Products

zohocorp
manageengine applications manager
17.0, 17.3 · ≤ 17.0 · 17.1 — 17.3

CVEs Like This One

CVE-2026-4108Same product class: network monitoring / SIEM
CVE-2025-9428Same product class: network monitoring / SIEM
CVE-2026-4107Same product class: network monitoring / SIEM
CVE-2025-11669Same product class: network monitoring / SIEM
CVE-2026-28703Same product class: network monitoring / SIEM
CVE-2025-11250Same product class: network monitoring / SIEM
CVE-2026-3879Same product class: network monitoring / SIEM
CVE-2026-28754Same product class: network monitoring / SIEM
CVE-2026-27655Same product class: network monitoring / SIEM
CVE-2026-28756Same product class: network monitoring / SIEM

References