CVE-2023-2291 - Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360 · CoreCVE

Back Back to CVE browser

HIGH

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360

Published Apr 26, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.81%

Description

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.

Affected products

Vendor n/a Product Zoho ManageEngine Multiple Products Default
n/a
- Version
  All
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Zoho ManageEngine Multiple Products

n/a

Version	Status	Constraints
All	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (1)

https://tenable.com/security/research/tra-2023-16
ExploitThird Party Advisory

Link	Providers	Tags
https://tenable.com/security/research/tra-2023-16		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner tenable

Published Apr 26, 2023

Updated Feb 3, 2025

Reserved Apr 25, 2023

Link CVE-2023-2291

CISA Vulnrichment

Updated Feb 3, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2023-2291

Severity n/a

Public date n/a

Links CVE-2023-2291