Executive Summary

This vulnerability in ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 involves a sensitive information logging issue where an authenticated user with access to logs could potentially obtain the sensitive agent token. Additionally, there was a risk that such a user could replay valid requests due to insufficient validation in the log handling mechanism. The issue was addressed by improving log validation to prevent replay attacks. [1]

Useful 0 Not Useful 0

Impact Analysis

If exploited, an authenticated user with access to logs could obtain sensitive agent tokens and potentially replay valid requests, which might allow unauthorized actions or access within the system. Although no actual misuse has been reported, this could lead to unauthorized access or manipulation of the Endpoint Central agent's operations. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by verifying the version of the ManageEngine Endpoint Central agent installed on your system. Specifically, check if the build number is prior to 11.4.2528.05. Since the issue involves sensitive information being logged, reviewing the logs for exposure of sensitive agent tokens by an authenticated user with log access may also help. However, no specific detection commands are provided in the available resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade your ManageEngine Endpoint Central agent to build 11.4.2528.05 or later. This involves logging into the Endpoint Central console, checking the current build number, downloading the latest Patch Package Manager (PPM) for your build, and applying the update. If further assistance is needed, contact ManageEngine support at [email protected]. [1]

Useful 0 Not Useful 0