CVE-2022-26777: 
Zoho ManageEngine Remote Access Plus vulnerability analysis and mitigation

CVE-2022-26777 is a security vulnerability discovered in ManageEngine Remote Access Plus versions before 10.1.2137.15. The vulnerability allows unauthorized users with Guest permissions to view the software's licensing information. The issue was reported by Matt Dunn and was officially disclosed on April 8, 2022 (ManageEngine Advisory, Raxis Blog).

The vulnerability stems from an Insecure Direct Object Reference (IDOR) issue where authenticated Guest users could make direct requests to the /dcapi/ API endpoint to retrieve license information. This allowed unauthorized access to sensitive installation details including the amount of users, managed systems, license ownership, and exact build number (Raxis Blog).

The vulnerability allows Guest users to access sensitive licensing information that should only be available to administrators. This includes details about the number of users, managed systems, license ownership, and build version information (ManageEngine Advisory).

The vulnerability was patched in ManageEngine Remote Access Plus version 10.1.2137.15, released on April 8, 2022. The fix ensures that only administrators can view licensing information. Users are advised to upgrade to this version or later to address the vulnerability. The issue does not affect Remote Access Plus Cloud installations (ManageEngine Advisory).