CVE-2024-36037: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zoho ManageEngine ADAudit Plus versions 7260 and below contains an insufficient access control vulnerability that allows unauthorized local agent machine users to view session recordings. The vulnerability was discovered and disclosed in May 2024, and was assigned CVE-2024-36037. This security issue affects all versions of ADAudit Plus up to and including version 7260 (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-863 (Incorrect Authorization), indicating a flaw in the authorization mechanism. The issue stems from insufficient access control enforcement on the session recording storage folder on agent-installed machines (NVD).

The vulnerability allows an insider with an authenticated session to view the recorded session data of other users on the affected machine. This could lead to unauthorized access to sensitive information captured in session recordings (Vendor Advisory).

ManageEngine has released a fix for this vulnerability in ADAudit Plus build 7270. Organizations are advised to update their ADAudit Plus instance to build 7270 using the service pack to remediate this security issue (Vendor Advisory).