CVE-2023-38332: 
Zoho ManageEngine ADManager Plus vulnerability analysis and mitigation

Zoho ManageEngine ADManager Plus through version 7201 contains a security vulnerability (CVE-2023-38332) that allows authenticated users to take over another user's account through sensitive information disclosure. The vulnerability was discovered and reported by dalt4sec via Zoho's Bug Bounty program and was fixed in build 7202 released on July 01, 2023 (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, requires no user interaction, and can result in high confidentiality impact (NVD).

The vulnerability allows 2FA-enabled technicians to gain unauthorized access to other privileged accounts by crafting an API request, potentially compromising the security of privileged user accounts in the system (Vendor Advisory).

Organizations using affected versions of ADManager Plus should immediately update their installation to build 7202 or later by installing the service pack. This update addresses the vulnerability and prevents unauthorized account access (Vendor Advisory).