ManageEngine Key Manager Plus authentication bypass and command injection flaws
Users who can log in to the key server can take keys that are not theirs.
Summary
Several flaws in ManageEngine Key Manager Plus let users with valid accounts skip the verification step, take keys and certificates belonging to others, or run commands. Versions before 7151 are affected.
Affected when
- attacker holds a valid login account
- Microsoft CA configured
- account with certificate deployment rights
What to do
Check that the product runs version 7151 or newer and read the vendor's advisory. No source names a fixed version.
Products and platforms
CVE IDs
Times
First published
First seen