CVE-2024-41140
Published: 29 January 2025
Summary
CVE-2024-41140 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Zohocorp Manageengine Applications Manager. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by identifying, reporting, and correcting the specific authorization flaw in the update user function through timely patching.
Enforces approved authorizations to prevent low-privilege authenticated attackers from exploiting the incorrect authorization in the update user function.
Limits potential impact by restricting low-privilege users to only necessary access, reducing the scope of unauthorized modifications enabled by the flaw.
NVD Description
Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.
Deeper analysisAI
CVE-2024-41140 is an incorrect authorization vulnerability (CWE-863) in the update user function of Zohocorp ManageEngine Applications Manager versions 174000 and prior. Published on 2025-01-29, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts.
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact unauthorized access to confidentiality and integrity, such as modifying user data, while leaving availability unaffected and scope unchanged.
ManageEngine has published a security update advisory addressing this issue, available at https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-41140.html, which security practitioners should consult for patch details and mitigation guidance.
Details
- CWE(s)