CVE-2023-50785: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

CVE-2023-50785 is a directory traversal vulnerability affecting Zoho ManageEngine ADAudit Plus versions before build 7270. The vulnerability was discovered and fixed on December 29, 2023, and allows admin users to view names of arbitrary directories via path traversal in the Disk Space Analysis feature (Vendor Advisory).

The vulnerability is classified as a path traversal issue (CWE-22) with a CVSS v3.1 base score of 2.7 (Low), and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires high privileges, can be exploited over the network, has low attack complexity, requires no user interaction, and only impacts confidentiality with low severity (NVD).

The vulnerability allows malicious administrators to list folders in file paths located outside the designated installation directory, potentially exposing sensitive directory information (Vendor Advisory).

The vulnerability has been patched in ManageEngine ADAudit Plus build 7270. Users are advised to update their ADAudit Plus instance to build 7270 or later using the service pack to remediate this vulnerability (Vendor Advisory).