Medium severity · published Oct 9, 2019
CVE-2019-17112
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012
4.3
CVSS
2.1%
EPSS
No
On KEV
Description
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Manageengine Datasecurity Plus · Zohocorp
4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +18 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17112
Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/cve-2019-17112/
Release Notes
https://www.manageengine.com/data-security/release-notes.html
More from Manageengine Datasecurity Plus
9.8
CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,…
9.8
CVE-2020-11532
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server
8.8
CVE-2020-11531
The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request
8.4
CVE-2026-2740
Remote Code Execution
8.1
CVE-2023-35785
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below,…