CVE-2023-6105
ManageEngine Information Disclosure in Multiple Products
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ManageEngine Information Disclosure in Multiple Products
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
- Record
CVE-2023-6105- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-58361
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
- Record
EUVD-2023-58361- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2jvx-3h5f-w2j7
An information disclosure vulnerability exists in multiple ManageEngine products that can result...
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
- Record
GHSA-2jvx-3h5f-w2j7- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
- Record
CVE-2023-6105- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
- manageengine access manager plus
- manageengine asset explorer
- manageengine service desk plus
- zohocorp manageengine access manager plus
- zohocorp manageengine adaudit plus
- zohocorp manageengine admanager plus
- zohocorp manageengine adselfservice plus
- zohocorp manageengine analytics plus
- zohocorp manageengine appcreator
- zohocorp manageengine application control plus
- zohocorp manageengine assetexplorer
- zohocorp manageengine browser security plus
Show 30 moreShow less
- zohocorp manageengine cloud security plus
- zohocorp manageengine datasecurity plus
- zohocorp manageengine device control plus
- zohocorp manageengine endpoint central
- zohocorp manageengine endpoint central msp
- zohocorp manageengine endpoint dlp plus
- zohocorp manageengine exchange reporter plus
- zohocorp manageengine firewall analyzer
- zohocorp manageengine log360 ueba
- zohocorp manageengine m365 manager plus
- zohocorp manageengine m365 security plus
- zohocorp manageengine mobile device manager plus
- zohocorp manageengine netflow analyzer
- zohocorp manageengine network configuration manager
- zohocorp manageengine opmanager
- zohocorp manageengine oputils
- zohocorp manageengine os deployer
- zohocorp manageengine pam360
- zohocorp manageengine password manager pro
- zohocorp manageengine patch connect plus
- zohocorp manageengine patch manager plus
- zohocorp manageengine recoverymanager plus
- zohocorp manageengine remote access plus
- zohocorp manageengine remote monitoring and management
- zohocorp manageengine secure gateway server
- zohocorp manageengine servicedesk plus
- zohocorp manageengine servicedesk plus msp
- zohocorp manageengine sharepoint manager plus
- zohocorp manageengine supportcenter plus
- zohocorp manageengine vulnerability manager plus
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6105 is a medium vulnerability (CVSS 5.5) in Manageengine Access Manager Plus, published November 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. No source names a fixed version.