CVE-2022-24447: 
Zoho ManageEngine Key Manager Plus vulnerability analysis and mitigation

An issue was discovered in Zoho ManageEngine Key Manager Plus before version 6200. A service exposed by the application allows a user with the level Operator to access stored SSL certificates and associated key pairs during export (NVD, Excellium Services).

The vulnerability was discovered on January 9, 2022, and was assigned a CVSS v3.1 score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The vulnerability affects the certificate export functionality in the application, where users with Operator-level privileges can access SSL certificates and their associated private keys (Excellium Services).

The vulnerability allows users with Operator-level access to access stored SSL certificates and their associated key pairs during the export process, potentially leading to unauthorized access to sensitive cryptographic materials (NVD).

The vulnerability requires a low level of privilege (Operator access) and can be exploited over the network with low attack complexity. No user interaction is required for exploitation (Excellium Services).

The vulnerability was fixed in version 6200 of Zoho ManageEngine Key Manager Plus. Users are advised to upgrade to this version or later to address the security issue (ManageEngine Release Notes).